CVE-2017-8899

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The...

Paragon Initiative Enterprises: Full Path Disclousure on https://airship.paragonie.com

Hi , i found an full path disclousure vulnerability on https://airship.paragonie.com For reproduce this vulnerability go to: https://airship.paragonie.com/my/cabins You will see something like this : Class '\ParagonIE\Airship\Cabins' not found 0 /var/www/paragonie/framework/Router.php236:...

Paragon Initiative Enterprises: Full Path Disclosure in airship.paragonie.com '/cabins/'

Hello Team, first am so sorry if i test this in your site, since i got problem to install in my own. So when i see your blog i got end point to https://airship.paragonie.com which is "Powered By Airship" or made using Airship CMS. step To Reproduce 1. register an account 2. navigate to...

Joomla jDBexport 3.2.10 Cross Site Scripting / Path Disclosure

Exploit Title: Joomla Component jDBexport 3.2.10 - Cross-site scripting / Full Path Disclosure Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Mojtaba Kazemi Home : https://extensions.joomla.org/extensions/extension/core-enhancements/data-reports/jdbexport/ Home :...

Joomla jDBexport 3.2.10 Cross Site Scripting / Path Disclosure Vulnerabilities

Joomla jDBexport component version 3.2.10 suffers from cross site scripting and path disclosure vulnerabilities Exploit Title: Joomla Component jDBexport 3.2.10 - Cross-site scripting / Full Path Disclosure Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Mojtaba Kazemi Home :...

CVE-2017-8057

In Joomla! 3.4.0 through 3.6.5 fixed in 3.7.0, multiple files caused full path disclosures on systems with enabled error reporting...

CVE-2017-8057

In Joomla! 3.4.0 through 3.6.5 fixed in 3.7.0, multiple files caused full path disclosures on systems with enabled error reporting...

CVE-2017-8057

Joomla! versions 3.4.0–3.6.5 are affected by CVE-2017-8057, which causes full path disclosure via multiple files when error reporting is enabled; fixed in 3.7.0. Connected docs corroborate this CVE as part of a set of issues and describe installation-path disclosure under error-verbose circumstan...

CVE-2017-8057

In Joomla! 3.4.0 through 3.6.5 fixed in 3.7.0, multiple files caused full path disclosures on systems with enabled error reporting...

Homebrew: [bot.brew.sh] Full Path Disclosure

Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...

Spots.IM Comments <= 3.0.0 - Multiple Vulnerabilities

Various XSS issues and Full Path Disclosure...

Adobe Multiple Products - XML Injection File Content Disclosure Exploit

Exploit for multiple platform in category web applications !/bin/bash Source: https://raw.githubusercontent.com/tsluyter/exploits/master/adobexmlinject.sh Exploit Title: Adobe XML Injection file content disclosure Date: 07-04-2017 Exploit Author: Thomas Sluyter Website: https://www.kilala.nl Vend...

Rockstar Games: full path disclosure on www.rockstargames.com via apache filename brute forcing

In this report, the researcher found that sending a request with an invalid Accept header to http://www.rockstargames.com/index resulted in a full path disclosure to the webroot. This was fixed as a result of the researcher's aid. Please be aware that after this report was resolved, we added "Pat...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information. Thank you @sp1d3rs for notifying us of this! It was a trivial Full Path Disclosure issue, but still worth reporting...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information. Thank you @sp1d3rs for notifying us of this! It was a trivial Full Path Disclosure issue, but still worth reporting...

CVE-2016-9855

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...

DEBIAN-CVE-2016-9855

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...

DEBIAN-CVE-2016-9854

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...

DEBIAN-CVE-2016-9853

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...

DEBIAN-CVE-2016-9852

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...