1452 matches found
CommPort <= 1.01 - Multiple Vulnerabilities
No description provided by source. -------------------------------------------- CommPort 1.01 = SQL Injection Vulnerability -------------------------------------------- Discovered by: Jean Pascal Pereira [email protected] Vendor information: A 'Community Portal' generator that can be tailored for...
GetSimple CMS 2.01 and 2.02 Administrative Credentials Disclosure
No description provided by source. Researcher: Michael Brooks Affecting: GetSimple CMS 2.01 and 2.02 Fixed:2.03 Vulnerability: Administrative Credentials Disclosure Vendor's Homepage: http://code.google.com/p/get-simple-cms download url for 2.01: http://www.box.net/get-simple/1/30435008/399754548...
ArrowChat 1.5.61 - Multiple Vulnerabilities
No description provided by source. Exploit Title: ArrowChat = 1.5.61 Multiple vulnerabilities Date: 01/01/2013 Exploit Author: Kallimero Version: 1.5.61, before, and maybe 1.6 Tested on: Debian Introduction ============ ArrowChat is a chat script, which is able to be integrate in various CMS, as...
Cobalt RaQ 2.0/3.0 Apache .htaccess Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1083/info The default configuration of Cobalt Raq2 and Raq3 servers allows remote access to .htaccess files. This could lead to unauthorized retrieval of username and password information for restricted portions of a...
Xataface Admin Auth Bypass Vulnerability
No description provided by source. ======================================================= Xataface Admin Auth Bypass Vulnerability ======================================================= + Discovered by : Xinapse + Site : firewire-security.com + Email : [email protected]...
Cloudflare: Bug Report
Vulnerability description modnegotiation is an Apache module responsible for selecting the document that best matches the clients capabilities, from one of several available documents. If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error...
Authentication-Bypass in CosmoShop ePRO V10.17.00 (and lower, maybe higher)
Issue: Authentication-Bypass in CosmoShop ePRO V10.17.00 and lower, maybe higher Author: l0om http://l0om.org Date: 26.02.2013 Overview: Cosmoshop provides an admin backup-function which saves .htaccess protected MySQL dump files in a backup directory. This directory does only prevent HTTP...
Yahoo!: readble .htaccess + Source Code Disclosure (+ .SVN repository)
Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...
C2FO: c2fo.com is releasing sensitive Information about Database Configuration.
Hello C2FO Securiity Team, Vulnerability Details : Disclosure of Database Username and Password of c2fo.com Description: Your configuration file of your website is available to download from your website c2fo.com.When i thought to pentest your site,i landed on https://c2fo.com .But instead of...
Cosmoshop pwd.cgi htaccess Creation
Author: l0om http://l0om.org Date: 10.03.2014 Overview: Cosmoshop is installed with a lot of admin scripts which should be only accessible as the logged-in admin. The script "pwd.cgi" is not protected and will create a .htaccess file for the admin-directory with any content. This may lead to...
Input validation
Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...
CVE-2013-1850
CVE-2013-1850 affects ownCloud Server prior to 4.0.13 and prior to 4.5.8 (4.5.x). The vulnerability is an incomplete blacklist in apps/contacts/import.php and apps/contacts/ajax/uploadimport.php that allows authenticated remote users to upload a .htaccess file and thereby achieve arbitrary PHP co...
CVE-2013-1850
Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...
CVE-2013-1850: Improper Control of Generation of Code
Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...
ownCloud 4.0.x, 4.5.x (upload.php, filename param) - Remote Code Execution
Exploit for hardware platform in category web applications Details: A remote code execution has been found and confirmed within ownCloud as an authenticated user. A successful attack could allow an authenticated attacker to execute PHP code, which could lead to a full compromise of the server and...
CosmoShop ePRO 10.17.00 Authentication Bypass
Issue: Authentication-Bypass in CosmoShop ePRO V10.17.00 and lower, maybe higher Author: l0om http://l0om.org Date: 26.02.2013 Overview: Cosmoshop provides an admin backup-function which saves .htaccess protected MySQL dump files in a backup directory. This directory does only prevent HTTP...
Debian DSA-2828-1 : drupal6 - several vulnerabilities
Multiple vulnerabilities have been discovered in Drupal, a fully-featured content management framework: vulnerabilities due to optimistic cross-site request forgery protection, insecure pseudo random number generation, code execution and incorrect security token validation. In order to avoid the...
Debian Security Advisory DSA 2828-1 (drupal6 - several vulnerabilities)
Multiple vulnerabilities have been discovered in Drupal, a fully-featured content management framework: vulnerabilities due to optimistic cross-site request forgery protection, insecure pseudo random number generation, code execution and incorrect security token validation. In order to avoid the...
DSA-2828-1 drupal6 - several
Bulletin has no description...
FreeBSD : drupal -- multiple vulnerabilities (d9649816-5e0d-11e3-8d23-3c970e169bc2)
Drupal Security Team reports : Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7. - Multiple vulnerabilities due to optimistic cross-site request forgery protection Form API validation - Drupal 6 and 7 - Multiple vulnerabilities due to weakness in pseudorandom numb...