1886 matches found
WordPress MP3 jPlayer Plugin <= 2.3.3 - Full Path Disclosure
Because of this vulnerability, attackers can disclose path information on wordpress sites. Solution Update the plugin...
Joomla! Component com_docman - Multiple Vulnerabilities
Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...
Joomla! Component com_docman - Multiple Vulnerabilities
Joomla! Component comdocman - Multiple Vulnerabilities Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...
Joomla Docman Path Disclosure / Local File Inclusion Vulnerabilities
Joomla Docman suffers from full path disclosure and local file inclusion vulnerabilities. Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: email protected Date:...
WordPress Vulcan Theme XSS / Disclosure/ DoS
Hello list! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme for...
Multiple vulnerabilities in Vulcan theme for WordPress + WAF bypass
Hello 3APA3A! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme fo...
Shopify: Header Misconfiguration - PHP API
Hey, Your index api page auth can easily be bypassed because it doesn't use proper auth practices in its PHP core. Here is the master code from Shopify: https://github.com/Shopify/shopifyphpapi/blob/master/index.php it says: if !isset$SESSION'shop' || !isset$SESSION'token' header"Location:...
Udemy: Multiple sub domain are vulnerable because of leaking full path
At the following address i have found debug.log file disclose the application full path onthe server. https://business.udemy.com/wp-content/debug.log http://about.udemy.com/wp-content/debug.log THe below URLs showing the version number of the application : http://about.udemy.com/readme.html...
WordPress Jigoshop Plugin <= 1.8 - Full Path Disclosure
This plugin is prone to a multiple script direct request path disclosure. Solution Upgrade the plugin...
WordPress NextGEN Gallery Plugin <= 1.7.3 - Full Path Disclosure
This plugin is prone to xml/ajax.php full path disclosure vulnerability. Solution Update the plugin...
WordPress RokIntroScroller Plugin <= 1.8 - Multiple Vulnerabilities
This plugin is prone to cross site scripting, denial of service, full path disclosure and arbitrary file upload vulnerabilities. Solution Update plugin...
WordPress NextGEN Gallery Plugin <= 1.9.11 - Full Path Disclosure
Because of this vulnerability, attackers can disclose certain system information. Solution Update the plugin...
WordPress Sintic Gallery Plugin - Full Path Disclosure
This plugin is prone to a full path disclosure vulnerability. Solution Update plugin...
WordPress Random Image Widget Plugin - Full Path Disclosure
This plugin is prone to a full path disclosure vulnerability. Solution Update plugin...
WordPress RokNewsPager Plugin <= 1.17 - Multiple Vulnerabilities
This plugin is prone to cross site scripting, denial of service, full path disclosure and arbitrary file upload vulnerabilities. Solution Update plugin...
WordPress Jigoshop Plugin <= 1.8 - Full Path Disclosure
This plugin is prone to a multiple script direct request path disclosure. Solution Upgrade the plugin...
WordPress RokMicroNews Plugin <= 1.5 - Multiple Vulnerabilities
This plugin is prone to cross site scripting, denial of service, full path disclosure and arbitrary file upload vulnerabilities. Solution Update plugin...
WordPress Exploit Scanner Plugin <= 1.3.3 - Multiple Vulnerabilities
This plugin is prone to a full path disclosure and security bypass vulnerabilities. Attackers can inject PHP backdoor into web site or execute OS commands. Solution Update the plugin...