Localize: PHP PDOException and Full Path Disclosure

hi in phrases on phrasemove or phraseChange action - parameter phrasekey set to array like phraseChangephraseKey11:test pdo quote show error : Warning: PDO::quote expects parameter 1 to be string, array given in /srv/data/web/vhosts/www.localize.im/htdocs/classes/Database.php on line 30 Fatal...

Localize: full path disclosure from false language

https://www.localize.im/projects/3t/languages/4xX Fatal error: Uncaught exception 'Exception' with message 'Unknown language ID 3083' in /srv/data/web/vhosts/www.localize.im/htdocs/classes/Language.php:423 Stack trace: 0 /srv/data/web/vhosts/www.localize.im/htdocs/classes/Language.php221:...

Ian Dunn: Path Disclosure Vulnerability

Hey , I'm Jamal in this report i want to show you a Vulnerability Found It In basic-google-maps-placemarks Pugin Description: Title : Path Disclosure Vulnerability Status : Unfixed Tested on : Firefox Author : Jamal Eddine Email : [email protected] Discovered : 2014/05/04 Report it : 2014/05/04...

WordPress Flexolio XSS / Disclosure / File Upload

Hello list! There are Content Spoofing, Cross-Site Scripting, Full path disclosure, Abuse of Functionality, Denial of Service and Arbitrary File Upload vulnerabilities in Flexolio for WordPress. Which contains TimThumb and CU3ER. In April 2011 I wrote about vulnerabilities in TimThumb...

Multiple vulnerabilities in Joomla-Base

Hello 3APA3A! These are Denial of Service, XML Injection, Cross-Site Scripting, Full path disclosure and Insufficient Anti-automation vulnerabilities in Joomla-Base. This is package of Joomla with different plugins with their vulnerabilities. These vulnerabilities are in Google Maps plugin for...

Multiple vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! There are multiple vulnerabilities in Js-Multi-Hotel plugin for WordPress. Earlier I wrote about two other vulnerabilities. These are Abuse of Functionality, Denial of Service, Cross-Site Scripting and Full path disclosure vulnerabilities in Js-Multi-Hotel plugin for WordPress. Ther...

CS, XSS and FPD vulnerabilities in multiple plugins with CU3ER for WordPress

Hello 3APA3A! Recently I disclosed vulnerabilities in CU3ER http://seclists.org/fulldisclosure/2014/Apr/244 and vulnerabilities in plugins with CU3ER for WordPress, Joomla, SilverStripe and Plone http://seclists.org/fulldisclosure/2014/Apr/251. This is popular flash file and in Google's index the...

Multiple vulnerabilities in JoomLeague for Joomla

Hello 3APA3A! These are Denial of Service, XML Injection, Cross-Site Scripting, Full path disclosure and Insufficient Anti-automation vulnerabilities in JoomLeague plugin for Joomla. These vulnerabilities are in Google Maps plugin for Joomla, which is used in this plugin. In 2013-2014 I wrote...

XSS and FPD vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! These are vulnerabilities in Js-Multi-Hotel plugin for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Js-Multi-Hotel 2.2.1 and previous versions. ------------------------- Affected vendors: ------------------------- Joomlaskin...

Multiple vulnerabilities in Flexolio for WordPress

Hello 3APA3A! There are Content Spoofing, Cross-Site Scripting, Full path disclosure, Abuse of Functionality, Denial of Service and Arbitrary File Upload vulnerabilities in Flexolio for WordPress. Which contains TimThumb and CU3ER. In April 2011 I wrote about vulnerabilities in TimThumb...

Vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! These are vulnerabilities in Js-Multi-Hotel plugin for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Js-Multi-Hotel 2.2.1 and previous versions. ------------------------- Affected vendors: ------------------------- Joomlaskin...

Localize: Full Path Disclosure (FPD) in www.localize.im

Hi, found another information disclosure vulnerability/Full Path Disclosure on your application. Proof of Concept ------------------------- GET : https://www.localize.im/projects/projiect ID/languages/Language ID POST CONTENT:...

Localize: Full Path Disclosure (FPD) in www.localize.im

Hi, I found an information disclosure vulnerability/Full Path Disclosure on your application. Proof of Concept ------------------------- GET : https://www.localize.im/projects/projiect ID/languages/Language ID POST CONTENT:...

StopTheHacker: Information Disclosure (FPD) - stopthehacker.com

Hi, I found a information disclosure vulnerabilityFull path disclosure Vulnerable link : http://www.stopthehacker.com/wp-includes/rss-functions.php You can see in the page the path of the site Fatal error: Call to undefined function deprecatedfile in...

Localize: Full Path Disclosure / Info Disclosure in Importing XML Section!

Hello, I found another information disclosure vulnerability/Full Path Disclosure on your application. now its on Import XML Section Proof of Concept ------------------------- POST : http://www.localize.io/import/ project ID POST CONTENT: -----------------------------97823247315770\r\n...

Localize: Full Path Disclosure / Info Disclosure in Creating New Group

Hi, I found another information disclosure vulnerability/Full Path Disclosure on your application. this time its on Creating New Group Section. Proof of Concept ------------------------- GET : http://www.localize.io/pages/createproject/ project ID POST CONTENT: CSRFToken=TOKEN...

Localize: Full Path Disclosure (FPD) in www.localize.io

Hi, I found an information disclosure vulnerability/Full Path Disclosure on your application. Proof of Concept ------------------------- GET : http://www.localize.io/pages/createproject/ project ID POST CONTENT: CSRFToken=TOKEN...

Localize: Full path disclosure

I signed up for localize with [email protected], and localize sent me a verification link which was: http://www.localize.io/verify/e6be646b24pdd3w6d5c27ppa9a267ee7 When I visited that link I found it was showing the following error: Fatal error: Call to a member function...

Concrete CMS: FULL PATH DISCLOSUR

Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...

JoomShopping 4.4.2 - Multiple XSS & FPD Vulnerabilities

Joomla extension called JoomShopping suffers on multiple Cross Site Scripting and Full Path Disclosure vulnerabilities because of poor POST & GET parameter filtration. Title: JoomShopping - Multiple XSS & FPD Date: 13.04.14 Vendor: joomshopping.com Demo: demo.joomshopping.com Dork:...