ownCloud: gallery_plus: Content Spoofing

Attacker can send his messages directly through url. He can easily put his message on error message parameter . Like that http://192.168.0.107/owncloud/index.php/apps/galleryplus/error?message=Welcome to owncloud. You can get pro account by sending us 10 usd directly to our official paypal...

Fedora 23 : mediawiki-1.25.2-2.fc23 (2015-13920)

T94116 SECURITY: Compare API watchlist token in constant time T97391 SECURITY: Escape error message strings in thumb.php T106893 SECURITY: Don't leak autoblocked IP addresses on Special:DeletedContributions T102562 Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia...

Username enumeration through the username parameter to the ViewUserHover resource.

It is possible to enumerate usernames through the secure/ViewUserHover resource through the username parameter. JIRA leaks the existence of a username by showing your entire name. 1. Log out of JIRA 2. Go to...

Cisco IOS-XE Fragmented Packet Resource Consumption Vulnerability

A vulnerability in the packet reassembly subsystem of Cisco IOS-XE could allow an unauthenticated, remote attacker to consume CPU resources which may lead to a denial of service DoS condition. The vulnerability is due to an error message that is triggered to the console and the syslog when a...

Notepad++ 6.7.3 - Crash PoC

Exploit for windows platform in category dos / poc Title: Notepad++ - Crash Date: 10/07/2015 Author: Rahul Pratap Singh @0x62626262 Vendor Homepage: https://notepad-plus-plus.org Download: https://notepad-plus-plus.org/download/v6.7.3.html Version: v6.7.3 Tested on: WindowsXPx86 & Windows7x86...

Stop Watching Page in email footer is broken

The link is broken, the error message says that the security token is missing...

postgresql: multiple issues

CVE-2015-3165 denial of service SSL clients disconnecting just before the authentication timeout expires can cause the server to crash via a double-free issue leading to denial of service. - CVE-2015-3166 information disclosure The replacement implementation of snprintf failed to check for errors...

Debian Security Advisory DSA 3270-1 (postgresql-9.4 - security update)

Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. CVE-2015-3165 Remote crash SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. CVE-2015-3166 Information exposure The replacement implementation of snprintf failed...

Moodle Error Message Redirection Vulnerability

Moodle is an open source web-based teaching and learning application. A security vulnerability in the handling of Moodle error messages allows an attacker to exploit the vulnerability to redirect to an external site for phishing and other attacks...

IP. Board <= 3.4.7 SQL Injection analysis-vulnerability warning-the black bar safety net

IPB stands for Invision Power Board is a PHP Development Forum program, foreign used more widely. In its 3. 4. 7 version and the previous presence of a SQL injection vulnerability, this article to its analysis. poc link http://seclists.org/fulldisclosure/2014/Nov/20 !/ usr/bin/env python Sunday,...

CVE-2015-2941

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...

Cross site scripting

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...

CVE-2015-2941

CVE-2015-2941 affects MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 when HHVM is used. The vulnerability arises from improper handling of a wddx_serialize_value call in api.php for invalid parameters in a wddx format request, which can lead to cross-site scripting v...

CVE-2015-2941

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...

CVE-2015-0991

Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information...

Information disclosure

Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information...

CVE-2015-0991

Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information...

rundeck memory overflow-vulnerability warning-the black bar safety net

rundeck execution error message ! wKioL1PyveCSuoDGAAByx6J0zSo074.jpg See the rundeck log:/tmp/rundeck/stacktrace. log Caused by: org. codehaus. groovy. runtime. InvokerInvocationException: java. lang. OutOfMemoryError: PermGen space Memory overflow, because I have not modified rundeck MaxPermSize...

CVE-2015-2703

Multiple cross-site scripting XSS vulnerabilities in Websense TRITON AP-WEB before 8.0.0 and V-Series 7.7 appliances allow remote attackers to inject arbitrary web script or HTML via the 1 ws-userip in the ws-encdata parameter to cve-bin/moreBlockInfo.cgi in the Data Security block page or 2...

某数字资源平台系统mssql注入

简要描述： mssql注入 详细说明： 厂商： http://gw.apabi.com/ 北京方正阿帕比技术有限公司 SQL注入点： /tree/deeptree.asp?DocGroupID=2&hide=1&CategoryTypeID=1 其中DocGroupI存在注入 报错： Microsoft OLE DB Provider for SQL Server 错误 '80040e14' ' where a.CategoryID ' or a.CategoryTypeID in select CategoryTypeID from DocGroup where DocGroupID=...