701 matches found
H2O vulnerable to directory traversal
Overview H2O is an open source web server software. H2O contains an issue in processing URL, which may result in a directory traversal CWE-22 vulnerability. Yusuke OSUMI reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...
FreeBSD : h2o -- directory traversal vulnerability (31ea7f73-5c55-11e5-8607-74d02b9a84d5)
Yakuzo reports : H2O up to version 1.4.4 / 1.5.0-beta1 contains a flaw in its URL normalization logic. When file.dir directive is used, this flaw allows a remote attacker to retrieve arbitrary files that exist outside the directory specified by the directive. H2O version 1.4.5 and version...
JVN#65602714: H2O vulnerable to directory traversal
H2O is an open source web server software. H2O contains an issue in processing URL, which may result in a directory traversal CWE-22 vulnerability. Impact A remote attacker may obtain arbitrary files on the server if "file.dir" directive is specified. Solution Update the Software Update to the...
h2o -- directory traversal vulnerability
Yakuzo reports: H2O up to version 1.4.4 / 1.5.0-beta1 contains a flaw in its URL normalization logic. When file.dir directive is used, this flaw allows a remote attacker to retrieve arbitrary files that exist outside the directory specified by the directive. H2O version 1.4.5 and version...
CVE-2014-6905
The H2O Human Harmony Organization aka com.netpia.ha.theh2o application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Design/Logic Flaw
The H2O Human Harmony Organization aka com.netpia.ha.theh2o application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-6905
The CVE-2014-6905 entry concerns the H2O Human Harmony Organization Android app (package com.netpia.ha.theh2o), version 1.6.5, which does not verify X.509 certificates from SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a cra...
CVE-2014-6905
The H2O Human Harmony Organization aka com.netpia.ha.theh2o application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
H2O-CMS <= 3.4 Insecure Cookie Handling Vulnerability
No description provided by source. ---------------------------------------------------------- H2O-CMS = 3.4 Insecure Cookie Handling Vulnerability Discovered By Mountassif Moad Download On http://sourceforge.net/projects/h2o-cms Home World http://v4-team.com...
H2O-CMS <= 3.4 - Remote Command Execution Exploit (mq = off)
No description provided by source. !/usr/bin/perl ---------------------------------------------------------- H2O-CMS = 3.4 Remote Command Execution Exploit mq = Off Discovered By StAkeRathotmaildotit Download On http://sourceforge.net/projects/h2o-cms...
H2O-CMS 3.4 PHP Code Injection and Cookie Authentication Bypass Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/31961/info H2O-CMS is prone to a PHP code-injection vulnerability and a cookie authentication-bypass vulnerability. An attacker can exploit the PHP code-injection issue to inject and execute arbitrary malicious PHP code i...
AplikaMedia CMS SQL Injection
Details & Title AplikaMedia CMS Sql injection Vulnerability Author : H3X Credit : Sepehr Security Team Vulnerable Page : pageinfo.php?idbrt= Google Dork : inurl:pageinfo.php?idbrt= Affected Software : aplikamedia CMS / aplikamedia.com Exploit +Exploit:...
H2O-CMS <= 3.4 Insecure Cookie Handling Vulnerability
No description provided by source. ---------------------------------------------------------- H2O-CMS = 3.4 Insecure Cookie Handling Vulnerability Discovered By Mountassif Moad Download On http://sourceforge.net/projects/h2o-cms Home World http://v4-team.com...
H2O-CMS <= 3.4 Remote Command Execution Exploit (mq = off)
No description provided by source. !/usr/bin/perl ---------------------------------------------------------- H2O-CMS = 3.4 Remote Command Execution Exploit mq = Off Discovered By StAkeRathotmaildotit Download On http://sourceforge.net/projects/h2o-cms...
H2O-CMS 3.4 - Insecure Cookie Handling
---------------------------------------------------------- H2O-CMS = 3.4 Insecure Cookie Handling Vulnerability Discovered By Mountassif Moad Download On http://sourceforge.net/projects/h2o-cms Home World http://v4-team.com ---------------------------------------------------------- Exploit:...
H2O-CMS 3.4 - Insecure Cookie Handling
H2O-CMS 3.4 - Insecure Cookie Handling ---------------------------------------------------------- H2O-CMS = 3.4 Insecure Cookie Handling Vulnerability Discovered By Mountassif Moad Download On http://sourceforge.net/projects/h2o-cms Home World http://v4-team.com...
H2O-CMS 3.4 - PHP Code Injection Cookie Authentication Bypass
H2O-CMS 3.4 - PHP Code Injection Cookie Authentication Bypass source: https://www.securityfocus.com/bid/31961/info H2O-CMS is prone to a PHP code-injection vulnerability and a cookie authentication-bypass vulnerability. An attacker can exploit the PHP code-injection issue to inject and execute...
h2ocms-exec.txt
!/usr/bin/perl ---------------------------------------------------------- H2O-CMS '";""; errorreporting0; echo"//athos"; "', 'dbserver' = '";""; include$REQUEST"i"; "', 'dbname' = '";""; eval$REQUEST"g"; "', 'dbusername' = '";""; echo shellexec$REQUEST"c"; "', 'dbpassword' = '";""; echo...
H2O-CMS 3.4 - Remote Command Execution
H2O-CMS 3.4 - Remote Command Execution !/usr/bin/perl ---------------------------------------------------------- H2O-CMS '";""; errorreporting0; echo"//athos"; "', 'dbserver' = '";""; include$REQUEST"i"; "', 'dbname' = '";""; eval$REQUEST"g"; "', 'dbusername' = '";""; echo shellexec$REQUEST"c"; "...
H2O-CMS 3.4 - PHP Code Injection / Cookie Authentication Bypass
source: https://www.securityfocus.com/bid/31961/info H2O-CMS is prone to a PHP code-injection vulnerability and a cookie authentication-bypass vulnerability. An attacker can exploit the PHP code-injection issue to inject and execute arbitrary malicious PHP code in the context of the webserver...