1230 matches found
CVE-2019-12938
The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI...
Mail.ru: Открытый .htaccess на cookery.zakazaka.ru
.htaccess file was available for reading via Web request on cookery.zakazaka.ru due to invalid configuration. While this misconfiguration could potentially lead to information disclosure, no sensitive information was actually leaked...
Unikrn: Full Path Disclosure
HI security team! we can see path on your resource. https://crm.unikrn.com/app/bundles/CampaignBundle/EventListener/LeadSubscriber.php You must create a ban on viewing the script from the outside using .htaccess Impact Full Path Disclosure https://www.owasp.org/index.php/FullPathDisclosure...
CVE-2016-10759
The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads...
Directory traversal
The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads...
CVE-2016-10759
The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads...
Joomla and WordPress Found Harboring Malicious Redirect Code
Security researchers are warning owners of Joomla and WordPress websites of a malicious redirect script that is pushing visitors to malicious websites. On Thursday, Eugene Wozniak, a security researcher with Sucuri, published a report outlining a rogue hypertext access .htaccess injector found on...
CVE-2016-10759
CVE-2016-10759 describes a path traversal vulnerability in Precurio 2.1 via the Xinha plugin. The flaw is in ExtendedFileManager/Classes/ExtendedFileManager.php, where ExtendedFileManager can be used to rename the .htaccess file that blocks PHP uploads, enabling directory traversal and resulting ...
The vulnerability of the Perl module of the Apache HTTP Server, related to the injection of code into the .htaccess file of the user, allows a hacker to execute arbitrary code.
The vulnerability of the Perl module used by the Apache HTTP Server is related to the injection of code into the .htaccess file of the user’s directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary Perl code on behalf of the user, thereby executing Apache HTTP serve...
Code injection
data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked...
CVE-2019-11344
data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked...
CVE-2019-11344
data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked...
CVE-2019-11344
CVE-2019-11344 affects Pluck 4.7.8 where data/inc/files.php allows remote code execution by uploading a .htaccess that sets SetHandler x-httpd-php for a .txt file, bypassing blocked PHP-related filename extensions. This is documented across multiple feeds (NVD, Red Hat, OSV, CVE lists). Root caus...
CVE-2019-11344
data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked...
Feng Office 3.7.0.5 - Remote Command Execution (Metasploit)
Feng Office 3.7.0.5 - Remote Command Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class MetasploitModule 'Feng Office 3.7.0.5 - Unauthenticated Remote Command...
InnoGames: Information disclosure via ".htaccess" at https://login.innogames.de
Hi team , i found insecure file Name: htaccess Normally, only the web server is allowed to read the .htaccess file, but in this case, it appears that there is a misconfiguration that is causing the contents of the .htaccess located at https://login.innogames.de/.htaccess to download file and read...
Remote Code Execution (RCE)
modperl is vulnerable to arbitrary code execution. There are no configuration options to allow administrator's control of HTTP request processing without also allowing unprivileged users to run Perl code on the system in the context of the Apache HTTPd process worker. This would allow an attacker...
CVE-2018-19422
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these...