1453 matches found
GetSimple CMS 2.01 and 2.02 Administrative Credentials Disclosure
No description provided by source. Researcher: Michael Brooks Affecting: GetSimple CMS 2.01 and 2.02 Fixed:2.03 Vulnerability: Administrative Credentials Disclosure Vendor's Homepage: http://code.google.com/p/get-simple-cms download url for 2.01: http://www.box.net/get-simple/1/30435008/399754548...
contentnow 1.30 (local/upload/delete) Multiple Vulnerabilities
No description provided by source. r0ut3r Presents... Another r0ut3r discovery! ContentNow 1.30 Local File Include & Arbitrary File Upload/Delete Vulnerabilities Software: ContentNow 1.30 Vulnerabilities Vendor: http://www.contentnow.mf4k.de/ Released: 2006/11/13 Discovered By: r0ut3r writ3r at g...
Hughes Technologies Mini SQL (mSQL) 2.0/2.0.10 Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/591/info Under certain versions of Mini SQL, the w3-msql CGI script allows users to view directories which are set for private access via .htaccess files. W3-mSQL converts any form data passed to a script into global Lite...
Xataface Admin Auth Bypass Vulnerability
No description provided by source. ======================================================= Xataface Admin Auth Bypass Vulnerability ======================================================= + Discovered by : Xinapse + Site : firewire-security.com + Email : [email protected]...
ownCloud 4.0.x, 4.5.x (upload.php, filename param) - Remote Code Execution
No description provided by source. Vulnerability title: Remote Code Execution in ownCloud CVE: CVE-2014-2044 Vendor: ownCloud Product: ownCloud Affected version: 4.0.x & 4.5.x Fixed version: 5.0 Reported by: Alejo Murillo Moya Details: A remote code execution has been found and confirmed within...
Cobalt RaQ 2.0/3.0 Apache .htaccess Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1083/info The default configuration of Cobalt Raq2 and Raq3 servers allows remote access to .htaccess files. This could lead to unauthorized retrieval of username and password information for restricted portions of a...
Cloudflare: Bug Report
Vulnerability description modnegotiation is an Apache module responsible for selecting the document that best matches the clients capabilities, from one of several available documents. If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error...
Authentication-Bypass in CosmoShop ePRO V10.17.00 (and lower, maybe higher)
Issue: Authentication-Bypass in CosmoShop ePRO V10.17.00 and lower, maybe higher Author: l0om http://l0om.org Date: 26.02.2013 Overview: Cosmoshop provides an admin backup-function which saves .htaccess protected MySQL dump files in a backup directory. This directory does only prevent HTTP...
Yahoo!: readble .htaccess + Source Code Disclosure (+ .SVN repository)
Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...
C2FO: c2fo.com is releasing sensitive Information about Database Configuration.
Hello C2FO Securiity Team, Vulnerability Details : Disclosure of Database Username and Password of c2fo.com Description: Your configuration file of your website is available to download from your website c2fo.com.When i thought to pentest your site,i landed on https://c2fo.com .But instead of...
Cosmoshop pwd.cgi htaccess Creation
Author: l0om http://l0om.org Date: 10.03.2014 Overview: Cosmoshop is installed with a lot of admin scripts which should be only accessible as the logged-in admin. The script "pwd.cgi" is not protected and will create a .htaccess file for the admin-directory with any content. This may lead to...
Input validation
Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...
CVE-2013-1850
CVE-2013-1850 affects ownCloud Server prior to 4.0.13 and prior to 4.5.8 (4.5.x). The vulnerability is an incomplete blacklist in apps/contacts/import.php and apps/contacts/ajax/uploadimport.php that allows authenticated remote users to upload a .htaccess file and thereby achieve arbitrary PHP co...
CVE-2013-1850
Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...
CVE-2013-1850: Improper Control of Generation of Code
Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...
ownCloud 4.0.x, 4.5.x (upload.php, filename param) - Remote Code Execution
Exploit for hardware platform in category web applications Details: A remote code execution has been found and confirmed within ownCloud as an authenticated user. A successful attack could allow an authenticated attacker to execute PHP code, which could lead to a full compromise of the server and...
CosmoShop ePRO 10.17.00 Authentication Bypass
Issue: Authentication-Bypass in CosmoShop ePRO V10.17.00 and lower, maybe higher Author: l0om http://l0om.org Date: 26.02.2013 Overview: Cosmoshop provides an admin backup-function which saves .htaccess protected MySQL dump files in a backup directory. This directory does only prevent HTTP...
Debian DSA-2828-1 : drupal6 - several vulnerabilities
Multiple vulnerabilities have been discovered in Drupal, a fully-featured content management framework: vulnerabilities due to optimistic cross-site request forgery protection, insecure pseudo random number generation, code execution and incorrect security token validation. In order to avoid the...
Debian Security Advisory DSA 2828-1 (drupal6 - several vulnerabilities)
Multiple vulnerabilities have been discovered in Drupal, a fully-featured content management framework: vulnerabilities due to optimistic cross-site request forgery protection, insecure pseudo random number generation, code execution and incorrect security token validation. In order to avoid the...
