PT-2018-14748

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1 Description The issue is related to an incomplete '.htaccess' file for blacklist filtering in the product page, allowing alternative cases for HTML execution. This includes files with no extension or unrecognized...

PT-2018-14749

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1 Description The issue concerns an incomplete '.htaccess' file for blacklist filtering in the product page of osCommerce. Specifically, the .htaccess file in the catalog/images/ directory bans the html extension, but...

blueimp jQuery Arbitrary File Upload Exploit

This Metasploit module exploits an arbitrary file upload in the sample PHP upload handler for blueimp's jQuery File Upload widget in versions 9.22.0 and below. Due to a default configuration in Apache 2.3.9+, the widget's .htaccess file may be disabled, enabling exploitation of this vulnerability...

Intelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE

This module exploits an authenticated file upload vulnerability in Subrion CMS versions 4.2.1 and lower. The vulnerability is caused by the .htaccess file not preventing the execution of .pht, .phar, and .xhtml files. Files with these extensions are not included in the .htaccess blacklist, hence...

MediaWiki 1.31.0 .htaccess Vulnerability - Linux

Mediawiki misses .htaccess files in the provided tarball used to protect some directories that shouldn SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

MediaWiki 1.31.0 .htaccess Vulnerability - Windows

Mediawiki misses .htaccess files in the provided tarball used to protect some directories that shouldn SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2018-13258

Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible...

UBUNTU-CVE-2018-13258

Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible...

Code injection

Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible...

CVE-2018-13258

Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible...

CVE-2018-13258 Tarball was missing .htaccess files

Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible...

CVE-2018-13258

Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible...

CVE-2018-13258

CVE-2018-13258 affects MediaWiki 1.31 prior to 1.31.1. The issue is that the tarball provided for distribution omits .htaccess files, which are intended to protect certain directories from public web access. As a result, directories that should not be web-accessible may be exposed. The vulnerabil...

CVE-2018-13258

Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible...

CVE-2018-13258: Exposure of Sensitive Information to an Unauthorized Actor

Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible...

PT-2018-11722

Name of the Vulnerable Software and Affected Versions MediaWiki version 1.31 Description The issue arises from missing .htaccess files in the provided tarball for MediaWiki, which are used to protect certain directories from being web accessible. Recommendations For MediaWiki version 1.31, update...

Important: mod_perl, mod24_perl

Issue Overview: modperl allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because contrary to the documentation there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting...

mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess

modperl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because contrary to the documentation there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting...

mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess

modperl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because contrary to the documentation there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting...

Important: Red Hat Security Advisory: rh-perl526-mod_perl security update

An update for rh-perl526-modperl is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...