phpmyadmin -- multiple vulnerabilities

The phpmyadmin development team reports: Weakness with cookie encryption Multiple XSS vulnerabilities Multiple XSS vulnerabilities PHP code injection Full path disclosure SQL injection attack Local file exposure Local file exposure through symlinks with UploadDir Path traversal with SaveDir and...

OLX: full path disclosure vulnerability at https://security.olx.com/*

in form of html comment it disclosing full path of file name Security.html in all https://security.olx.com/ links...

WordPress Count Per Day Plugin <= 3.2.3 - Full Path Disclosure

This plugin is prone to multiple script direct request path disclosure vulnerability. Solution Update the plugin...

Instacart: Image Upload Path Disclosure

Hi, Firstly,I couldn't see anything about Path Disclosure in your policy,so I've decided to report it. Steps to reproduce : 1-Create a list for a store 2-Add background image from link File has to be .svg like aaa.com/aaa.svg 3-Then it will give an error Let's take a look to that error...

Shopify: (FULL PATH DISCLOSURE) Unknown MySQL server host 'shardm-reader.chi2.shopify.io'

Hello, Found a website of you guys that is poiting to: shardm-reader.chi2.shopify.io' This domain is disclosure fill path because there is none MySQL server host. POC: https://104.196.154.1/ Response a whole page with path disclosures: lib/patches/mysqlmonitoring.rb:19:in connect'...

Ian Dunn: [Not just a server configuration issue] Full Path Disclosure

Hey, I've just found a 'full path disclosure' in basic-google-maps-placemarks, so it's not just a server configuration issue! I've tested it on different servers including windows, ubuntu, CentOS etc.. PoC So, if we visit wp-content/plugins/basic-google-maps-placemarks/unit-tests.php it is clearl...

Joomla com_jotloader 2.2.1 website path disclosure vulnerability

No description provided by source...

Full path disclosure

PMASA-2016-33 Announcement-ID: PMASA-2016-33 Date: 2016-07-12 Summary Full path disclosure Description A full path disclosure vulnerability was discovered where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. Severity We consider...

Paragon Initiative Enterprises: Full Path Disclosure by removing CSRF token

Hello, you can get an error and full path disclosure by following these steps: on any user generated POST request such as during login, or changing user data remove the CSRF token from the post request entirely. For example, on the login POST request,...

phpMyAdmin directory traversal vulnerability (CNVD-2016-04566)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A directory traversal vulnerability exists in the...

ExpressionEngine: Full path + some back-end code disclosure

Hello, Ironically enough, I just discovered a full path disclosure issue. When an admin edits their personal information, a request like the following gets sent: POST /ee/admin.php?/cp/members/profile/settings&id=1 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:45.0...

Joomla com_jotloader - Full Path Disclosure Vulnerability

No description provided by source...

OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability

Document Title: =============== OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1868 Release Date: ============= 2016-07-04 Vulnerability Laboratory ID VL-ID: ==================================== 186...

DEBIAN-CVE-2016-5730

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving 1 an array value to FormDisplay.php, 2 incorrect data to validate.php, 3 unexpected data to Validator.php, 4 a missing config directory...

OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability

Document Title: =============== OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1868 Release Date: ============= 2016-07-03 Vulnerability Laboratory ID VL-ID: ==================================== 186...

Paragon Initiative Enterprises: Full path disclosure when CSRF validation failed

Hi again , There are Full path disclosure in airship when the CSRF validation failed . It will show the full path with files this is can be useful for an attacker if he need some information about files and path ,identified the script and path . PoC : Host: bridge.cspr.ng User-Agent: Mozilla/5.0...

openSUSE Security Update : phpMyAdmin (openSUSE-2016-806)

This phpMyAdmin update to version 4.4.15.7 fixes the following issues : Issues fixed: Setup script doesn't use input type 'password' in all relevant locations Security issues fixed : - PMASA-2016-17 CVE-2016-5701, CWE-661 https://www.phpmyadmin.net/security/PMASA-2016-17/ - BBCode injection...

phpMyAdmin Full Path Disclosure Vulnerability

phpmyadmin is an online management tool for MySQL databases. phpmyadmin versions 4.4.x, 4.6.x, 4.0.x are available at . /setup/, . /examples/ are vulnerable to a full path disclosure vulnerability, which can be exploited by an attacker with a constructed script that triggers a PHP error message t...

Multiple full path disclosure vulnerabilities

PMASA-2016-23 Announcement-ID: PMASA-2016-23 Date: 2016-06-23 Summary Multiple full path disclosure vulnerabilities Description This PMASA contains information on multiple full-path disclosure vulnerabilities reported in phpMyAdmin. By specially crafting requests in the following areas, it is...

Joomla Joomdoc Extension Path Disclosure Vulnerability

Joomla extension Joomdoc is prone to path disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla...