WordPress Gravity Forms: Multiple Form Instances plugin <= 1.1.1 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Gravity Forms: Multiple Form Instances versions = 1.1.1...

CVE-2024-6550

The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due to the plugin leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full path of...

CVE-2024-6550

CVE-2024-6550 refers to Gravity Forms: Multiple Form Instances for WordPress. The connected Red Hat entry confirms a Full Path Disclosure in versions up to 1.1.1 caused by test files with display_errors on, allowing unauthenticated access to the web app path. Impact is Information Exposure (low c...

CVE-2024-6550 Gravity Forms: Multiple Form Instances <= 1.1.1 - Unauthenticated Full Path Disclosure

The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due to the plugin leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full path of...

CVE-2024-6550 Gravity Forms: Multiple Form Instances <= 1.1.1 - Unauthenticated Full Path Disclosure

The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due to the plugin leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full path of...

WordPress Gravity Forms: Multiple Form Instances Plugin <= 1.1.1 is vulnerable to Full Path Disclosure (FPD)

Software Gravity Forms: Multiple Form Instances Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-6550 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID af3116244e6e Credits...

WordPress SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer Plugin <= 3.10.8 is vulnerable to Full Path Disclosure (FPD)

Software SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer Type Plugin Vulnerable versions = 3.10.8 Fixed in 3.10.9 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-6556 Patch priority Low CVSS severity Low 5.3 Developer WPMU DEV PSID...

PT-2024-37711 · WordPress · Branda – White Label Wordpress

Name of the Vulnerable Software and Affected Versions: The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress versions up to, and including, 3.4.18 Description: The plugin is vulnerable to Full Path Disclosure due to utilizing composer without preventing direct acce...

PT-2024-37713 · WordPress · Smartcrawl

Name of the Vulnerable Software and Affected Versions: SmartCrawl WordPress SEO checker plugin versions up to, and including, 3.10.8 Description: The issue is due to the plugin utilizing mobiledetect without preventing direct access to the files, making it possible for unauthenticated attackers t...

PT-2024-37453 · WordPress · Duplicator

Name of the Vulnerable Software and Affected Versions: Duplicator plugin for WordPress versions up to, and including, 1.5.9 Description: The issue allows unauthenticated attackers to obtain the full path to instances, which may be used in combination with other vulnerabilities or to simplify...

WordPress plugin SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

ALPINE-CVE-2024-38475

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

CVE-2024-5735

Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0...

CVE-2024-5735 Full Path Disclosure in AdmirorFrames Joomla! Extension

Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0...

CVE-2024-5735 Full Path Disclosure in AdmirorFrames Joomla! Extension

Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0...

CVE-2024-5735

CVE-2024-5735 describes a Full Path Disclosure in the AdmirorFrames Joomla! extension, allowing an unauthenticated attacker to retrieve the web root folder location via afHelper.php. Affected: AdmirorFrames before 5.0. The connected sources confirm the vulnerability exists and reference the affec...

PT-2024-37111 · Joomla · Admirorframes

Name of the Vulnerable Software and Affected Versions: AdmirorFrames versions prior to 5.0 Description: The issue allows an unauthorized attacker to retrieve the location of the web root folder due to a Full Path Disclosure vulnerability in the afHelper.php script of the AdmirorFrames Joomla!...

RHEL 9 : podman (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - golang: out-of-bounds read in golang.org/x/text/language leads to DoS CVE-2021-38561 Note that Nessus has not teste...

GHSA-PQFV-97HJ-G97G TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure

It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation...

TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure

It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation...