Moodle 'lib/moodlelib.php' Sensitive Information Disclosure Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A sensitive information disclosure vulnerability exists in the Moodle 'lib/moodlelib.php' script. As the theme uses the blocks-regions...

JSON-RPC API allows anonymous content rendering

The renderContent method can be used by anonymous users, leaking information, and allowing macro execution. Should the entire JSON-RPC be inaccessible to anonymous users if anonymous users can't use confluence?...

HackerOne: Flawed account creation process allows registration of usernames corresponding to existing file names

The account creation process allows to set up account names corresponding to names of server ressources, e.g. I just successfully created an account robots.txt which results in a profile path of https://hackerone.com/robots.txt and results in an bugged account as accessing account settings etc is...

Inaccessible page titles leaked by Share Page API

The Share Page API exposes a REST endpoint that is available to authenticated users of Confluence. It is possible for any user to share any page simply by specifying the corresponding numeric id and the resulting notification includes the title of the shared page. In particular, a user may obtain...

The Windows File System vulnerability-a small vulnerability, big-vulnerability warning-the black bar safety net

Windows useful file to replace the command, to bypass the File Protection Used to replace file replace, even being used of the file can also be replaced. Very invincible. For example: in C:\create a directory, c:\aaa Then copy an mp3 to c:\aaa and named to the c:\aaa\a. mp3 Then copy another...

TYPSoft FTP Server 1.11 - 'ABORT' Remote Denial of Service

/ Soft : TYPSoft FTP Server Version: 1.11 Denial of Service in TYPSoft FTP Server up to 1.11 no crash Just the server is saturated, it stops responding. -------------------------------------------------------------------------------------- The vulnerability is caused due to an error in handling t...

Ubuntu Update for enigmail vulnerability USN-427-1

Ubuntu Update for Linux kernel vulnerabilities USN-427-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN4271.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for enigmail vulnerability USN-427-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

CVE-2006-2334

The RtlDosPathNameToNtPathNameU API function in NTDLL.DLL in Microsoft Windows 2000 SP4 and XP SP2 does not properly convert DOS style paths with trailing spaces into NT style paths, which allows context-dependent attackers to create files that cannot be accessed through the expected DOS path or...

Sql injection

SQL injection vulnerability in dropbase.php in MitriDAT Web Calendar Pro allows remote attackers to modify internal SQL queries and cause a denial of service inaccessible database via the tabls parameter...

CVE-2003-1093: Undefined Security Weakness

BEA WebLogic Server 6.1, 7.0 and 7.0.0.1, when routing messages to a JMS target domain that is inaccessible, may leak the user's password when it throws a ResourceAllocationException...

CVE-2002-0009

In Bugzilla versions before 2.14.1, a user with Bugs Access privileges could trigger information disclosure by submitting a bug and reading the resulting Product pulldown menu, revealing other products not accessible to them. The root cause is insufficient access controls around the Product pulld...

SUIDPerl 5.6 - Information Disclosure

SUIDPerl 5.6 - Information Disclosure source: https://www.securityfocus.com/bid/6282/info An information disclosure vulnerability has been reported for SuidPerl. Reportedly, it is possible for an attacker to determine whether files exist in non-accessible directories. An attacker can exploit this...