28 matches found
CVE-2014-2538 rubygem rack-ssl: URL error display XSS
Cross-site scripting XSS vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack...
On internal error, JIRA will display error information to the user (in the browser)
When JIRA bundled tomcat?? encounters an internal error it displays error information to the user in the browser. This can leak internal, possibly sensitive, information. It should report that there was an error and inform the user to contact their JIRA admin...
Multiple Web Applications | Full Path Disclosure
The following web applications are found to have full path disclosure flaws Ref: WASC-13, CWE-200. ----------------------------------------- htmlpurifier-4.2.0 phpids-0.6.5 PhpSecInfo 111WebCalendar-1.2.3 adodb aef-1.0.8 ATutor-2.0 auth b2evolution-3.3.3 bbpress-1.0.2 cftp-r80 claroline-1.9.7...
Use google to conduct“penetration testing”-vulnerability warning-the black bar safety net
One, use google to find is people who installed a php webshell back door of the host, and test the ability to use; Second, use google to find exposed INC sensitive information. OK, now we start: 1. Lookup using a php webshell We in the google search box fill in: Code: intitle:"php shell" "Enable...
Be careful to guard against Trojan horses is such a camouflage, you know?-vulnerability warning-the black bar safety net
Trojan is the use of camouflage methods 1. Modified icon Trojan service to end the use of icons is also a luxurious, Trojans are often deliberately disguised as XT. HTML, etc. you may think that the system is not much harm to the file icon, so it is easy to tempt you opened it. See, the Trojan is...
Horde Turba status.php Path Disclosure
There is a flaw in the file 'status.php' of this CGI which may allow an attacker to retrieve the physical path of the remote web root. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Date: 17 May 2003 13:18:59 -0000 From: Lorenzo Manuel Hernandez Garcia-Hierro To:...
CVE-2002-0253
CVE-2002-0253 affects PHP: when display_errors is not Off in php.ini, remote attackers can cause a PHP program to disclose the physical path of an include file by exploiting a trailing slash, as the base path is altered and the include directive fails, leaking the path in the error message. Remed...