1230 matches found
Hughes Technologies Mini SQL (mSQL) 2.0/2.0.10 Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/591/info Under certain versions of Mini SQL, the w3-msql CGI script allows users to view directories which are set for private access via .htaccess files. W3-mSQL converts any form data passed to a script into global Lite...
contentnow 1.30 (local/upload/delete) Multiple Vulnerabilities
No description provided by source. r0ut3r Presents... Another r0ut3r discovery! ContentNow 1.30 Local File Include & Arbitrary File Upload/Delete Vulnerabilities Software: ContentNow 1.30 Vulnerabilities Vendor: http://www.contentnow.mf4k.de/ Released: 2006/11/13 Discovered By: r0ut3r writ3r at g...
CommPort <= 1.01 - Multiple Vulnerabilities
No description provided by source. -------------------------------------------- CommPort 1.01 = SQL Injection Vulnerability -------------------------------------------- Discovered by: Jean Pascal Pereira [email protected] Vendor information: A 'Community Portal' generator that can be tailored for...
CGIScript.net csPassword.CGI 1.0 HTAccess File Modification Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4888/info CGIScript.net provides various webmaster related tools and is maintained by Mike Barone and Andy Angrick. A vulnerability has been reported in the csPassword.cgi script developed by CGIScript.net. It is possible...
GetSimple CMS 2.01 and 2.02 Administrative Credentials Disclosure
No description provided by source. Researcher: Michael Brooks Affecting: GetSimple CMS 2.01 and 2.02 Fixed:2.03 Vulnerability: Administrative Credentials Disclosure Vendor's Homepage: http://code.google.com/p/get-simple-cms download url for 2.01: http://www.box.net/get-simple/1/30435008/399754548...
Boonex Dolphin 6.1.2 - Multiple Remote File Inclusion Vulnerabilities
No description provided by source. Name Of Script : Dolphin PHP Version : 6.1.2 Download From : http://heanet.dl.sourceforge.net/sourceforge/boonex-dolphin/Dolphin-v.6.1.2-Free.zip Found By : RoMaNcYxHaCkEr RoMaNTiC-TeaM My Home Page : WwW.4RxH.CoM We Will Be Back Soon & Tryag.cc/cc Member From...
ShoutPro <= 1.5.2 (shout.php) Remote Code Injection Exploit
No description provided by source. ?/ File: shoutbox.php Affects: ShoutPro 1.5.2 may affect earlier versions Date: 17th April 2007 Issue Description: =========================================================================== ShoutPro 1.5.2 fails to fully sanitize user input $shout that it writes...
Cloudflare: Bug Report
Vulnerability description modnegotiation is an Apache module responsible for selecting the document that best matches the clients capabilities, from one of several available documents. If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error...
Authentication-Bypass in CosmoShop ePRO V10.17.00 (and lower, maybe higher)
Issue: Authentication-Bypass in CosmoShop ePRO V10.17.00 and lower, maybe higher Author: l0om http://l0om.org Date: 26.02.2013 Overview: Cosmoshop provides an admin backup-function which saves .htaccess protected MySQL dump files in a backup directory. This directory does only prevent HTTP...
Yahoo!: readble .htaccess + Source Code Disclosure (+ .SVN repository)
Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...
C2FO: c2fo.com is releasing sensitive Information about Database Configuration.
Hello C2FO Securiity Team, Vulnerability Details : Disclosure of Database Username and Password of c2fo.com Description: Your configuration file of your website is available to download from your website c2fo.com.When i thought to pentest your site,i landed on https://c2fo.com .But instead of...
Cosmoshop pwd.cgi htaccess Creation
Author: l0om http://l0om.org Date: 10.03.2014 Overview: Cosmoshop is installed with a lot of admin scripts which should be only accessible as the logged-in admin. The script "pwd.cgi" is not protected and will create a .htaccess file for the admin-directory with any content. This may lead to...
Input validation
Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...
CVE-2013-1850
Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...
CVE-2013-1850
CVE-2013-1850 affects ownCloud Server prior to 4.0.13 and prior to 4.5.8 (4.5.x). The vulnerability is an incomplete blacklist in apps/contacts/import.php and apps/contacts/ajax/uploadimport.php that allows authenticated remote users to upload a .htaccess file and thereby achieve arbitrary PHP co...
ownCloud 4.0.x, 4.5.x (upload.php, filename param) - Remote Code Execution
Exploit for hardware platform in category web applications Details: A remote code execution has been found and confirmed within ownCloud as an authenticated user. A successful attack could allow an authenticated attacker to execute PHP code, which could lead to a full compromise of the server and...
CosmoShop ePRO 10.17.00 Authentication Bypass
Issue: Authentication-Bypass in CosmoShop ePRO V10.17.00 and lower, maybe higher Author: l0om http://l0om.org Date: 26.02.2013 Overview: Cosmoshop provides an admin backup-function which saves .htaccess protected MySQL dump files in a backup directory. This directory does only prevent HTTP...
Debian DSA-2828-1 : drupal6 - several vulnerabilities
Multiple vulnerabilities have been discovered in Drupal, a fully-featured content management framework: vulnerabilities due to optimistic cross-site request forgery protection, insecure pseudo random number generation, code execution and incorrect security token validation. In order to avoid the...
DSA-2828-1 drupal6 - several
Bulletin has no description...
Debian Security Advisory DSA 2828-1 (drupal6 - several vulnerabilities)
Multiple vulnerabilities have been discovered in Drupal, a fully-featured content management framework: vulnerabilities due to optimistic cross-site request forgery protection, insecure pseudo random number generation, code execution and incorrect security token validation. In order to avoid the...