CVE-2016-6610

A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are...

CVE-2016-6610

A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are...

Multiple full path disclosure vulnerabilities

PMASA-2016-63 Announcement-ID: PMASA-2016-63 Date: 2016-11-25 Updated: 2016-12-06 Summary Multiple full path disclosure vulnerabilities Description By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which...

QIWI: [vitrina.contact-sys.com] Full Path Disclosure

Уязвимый сценарий: /user/all/orders Уязвимые параметры: order, sort PoC: http://vitrina.contact-sys.com/user/all/orders?order=ordernumber&sort=desc http://vitrina.contact-sys.com/user/all/orders?order=ordernumber&sort=desc Примеры путей: █████pluginstyletable.inc...

VBScan 0.1.7 - Black Box vBulletin Vulnerability Scanner

OWASP VBScan short for VBulletin Vulnerability Scanner is an opensource project in perl programming language to detect VBulletin CMS vulnerabilities and analyses them . Why OWASP VBScan ? If you want to do a penetration test on a vBulletin Forum, OWASP VBScan is Your best shot ever! This Project ...

OLX: Full path disclosure vulnerability at http://corporate.olx.ph

Hello Security team, Request: if you think the reported issues have acceptable risk and you are not going to make changes then kindly request to mark as Informative or let me close it. I'm not sure if this is the normal behavior of the page, but i thought i would be a good idea reporting to you...

QIWI: [id.rapida.ru] Full Path Disclosure

Уязвимый сценарий: dp.php Включено отображение подробной информации об ошибках. При использовании массива вместо строки выводится полный путь до веб директории. Примеры путей: ██████████████████ ███████ █████████ Примеры запросов: Пример 1 нужно подставить валидное значение сессии http POST /dp.p...

Security update for phpMyAdmin (important)

phpMyAdmin was updated to version 4.4.15.8 2016-08-16 to fix the following issues: - Upstream changelog for 4.4.15.8: Improve session cookie code for openid.php and signon.php example files Full path disclosure in openid.php and signon.php example files Unsafe generation of BlowfishSecret when no...

OLX: full path disclosure vulnerability at https://security.olx.com/*

in form of html comment it disclosing full path of file name Security.html in all https://security.olx.com/ links...

WordPress Count Per Day Plugin <= 3.2.3 - Full Path Disclosure

This plugin is prone to multiple script direct request path disclosure vulnerability. Solution Update the plugin...

Shopify: (FULL PATH DISCLOSURE) Unknown MySQL server host 'shardm-reader.chi2.shopify.io'

Hello, Found a website of you guys that is poiting to: shardm-reader.chi2.shopify.io' This domain is disclosure fill path because there is none MySQL server host. POC: https://104.196.154.1/ Response a whole page with path disclosures: lib/patches/mysqlmonitoring.rb:19:in connect'...

Ian Dunn: [Not just a server configuration issue] Full Path Disclosure

Hey, I've just found a 'full path disclosure' in basic-google-maps-placemarks, so it's not just a server configuration issue! I've tested it on different servers including windows, ubuntu, CentOS etc.. PoC So, if we visit wp-content/plugins/basic-google-maps-placemarks/unit-tests.php it is clearl...

Paragon Initiative Enterprises: Full Path Disclosure by removing CSRF token

Hello, you can get an error and full path disclosure by following these steps: on any user generated POST request such as during login, or changing user data remove the CSRF token from the post request entirely. For example, on the login POST request,...

ExpressionEngine: Full path + some back-end code disclosure

Hello, Ironically enough, I just discovered a full path disclosure issue. When an admin edits their personal information, a request like the following gets sent: POST /ee/admin.php?/cp/members/profile/settings&id=1 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:45.0...

Joomla com_jotloader - Full Path Disclosure Vulnerability

No description provided by source...

OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability

Document Title: =============== OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1868 Release Date: ============= 2016-07-04 Vulnerability Laboratory ID VL-ID: ==================================== 186...

DEBIAN-CVE-2016-5730

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving 1 an array value to FormDisplay.php, 2 incorrect data to validate.php, 3 unexpected data to Validator.php, 4 a missing config directory...

Paragon Initiative Enterprises: Full path disclosure when CSRF validation failed

Hi again , There are Full path disclosure in airship when the CSRF validation failed . It will show the full path with files this is can be useful for an attacker if he need some information about files and path ,identified the script and path . PoC : Host: bridge.cspr.ng User-Agent: Mozilla/5.0...

openSUSE Security Update : phpMyAdmin (openSUSE-2016-806)

This phpMyAdmin update to version 4.4.15.7 fixes the following issues : Issues fixed: Setup script doesn't use input type 'password' in all relevant locations Security issues fixed : - PMASA-2016-17 CVE-2016-5701, CWE-661 https://www.phpmyadmin.net/security/PMASA-2016-17/ - BBCode injection...

phpMyAdmin Full Path Disclosure Vulnerability

phpmyadmin is an online management tool for MySQL databases. phpmyadmin versions 4.4.x, 4.6.x, 4.0.x are available at . /setup/, . /examples/ are vulnerable to a full path disclosure vulnerability, which can be exploited by an attacker with a constructed script that triggers a PHP error message t...