4356 matches found
WordPress MP3-jPlayer 2.3.2 Path Disclosure Vulnerability
WordPress MP3-jPlayer plugin version 2.3.2 suffers from a path disclosure vulnerability. Title: Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-12 Download Site: https://wordpress.org/plugins/mp3-jplayer/ Vendor:...
WordPress MP3 jPlayer Plugin <= 2.3.3 - Full Path Disclosure
Because of this vulnerability, attackers can disclose path information on wordpress sites. Solution Update the plugin...
WordPress MP3 jPlayer Plugin <= 2.3.3 - Full Path Disclosure
Because of this vulnerability, attackers can disclose path information on wordpress sites. Solution Update the plugin...
MP3-jPlayer <= 2.4.2 - Full Path Disclosure
The download.php code allows arbitrary users to disclose path information on WordPress sites with this plugin installed. 120 $info = " 121 Get: " . $mp3 . " 122 Sent: " . $sent . " 123 File: " . $file . " 124 Open: " . $SERVER'DOCUMENTROOT' . $fp . " 125 Root: " . $rooturl . " 126 pID: "...
MP3-jPlayer <= 2.4.2 - Full Path Disclosure
The download.php code allows arbitrary users to disclose path information on WordPress sites with this plugin installed. 120 $info = " 121 Get: " . $mp3 . " 122 Sent: " . $sent . " 123 File: " . $file . " 124 Open: " . $SERVER'DOCUMENTROOT' . $fp . " 125 Root: " . $rooturl . " 126 pID: "...
WordPress MP3-jPlayer 2.3.2 Path Disclosure
Title: Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-12 Download Site: https://wordpress.org/plugins/mp3-jplayer/ Vendor: https://profiles.wordpress.org/simonward-1/ Vendor Notified: 2015-08-06 Vendor Contact: Description:...
subversion -- multiple vulnerabilities
Subversion reports: CVE-2015-3184: Subversion's modauthzsvn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4. CVE-2015-3187: Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by...
Keybase: Full path disclosure at https://keybase.io/_/api/1.0/invitation_request.json
When we send a POST-request to https://keybase.io//api/1.0/invitationrequest.json with multiple fullname parameters, for example: [email protected]&fullname=1&fullname=2 we get an error response, which contains infromation about the server paths and code: TypeError: Object 1,2 has no method...
Joomla! Component com_docman - Multiple Vulnerabilities
Joomla! Component comdocman - Multiple Vulnerabilities Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...
Joomla! Component com_docman - Multiple Vulnerabilities
Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...
Joomla Docman Path Disclosure / Local File Inclusion
Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 13/07/2015 Vendor Homepage:...
Joomla Docman Path Disclosure / Local File Inclusion Vulnerabilities
Joomla Docman suffers from full path disclosure and local file inclusion vulnerabilities. Joomla docman Component 'comdocman' Full Path DisclosureFPD & Local File Disclosure/IncludeLFD/LFI CWE: CWE-200FPD CWE-98LFI/LFD Risk: High Author: Hugo Santiago dos Santos Contact: email protected Date:...
WordPress Vulcan Theme XSS / Disclosure/ DoS
Hello list! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme for...
Multiple vulnerabilities in Vulcan theme for WordPress + WAF bypass
Hello 3APA3A! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme fo...
SysAid Path Disclosure Vulnerability
SysAid Help Desktop Software is prone to a path disclosure vulnerability Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...
SysAid Help Desk 14.4 - Multiple Vulnerabilities
SysAid Help Desk 14.4 - Multiple Vulnerabilities Multiple vulnerabilities in SysAid Help Desk 14.4 Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 03/06/2015 / Last updated:...
Shopify: Header Misconfiguration - PHP API
Hey, Your index api page auth can easily be bypassed because it doesn't use proper auth practices in its PHP core. Here is the master code from Shopify: https://github.com/Shopify/shopifyphpapi/blob/master/index.php it says: if !isset$SESSION'shop' || !isset$SESSION'token' header"Location:...
WordPress RokNewsPager Plugin <= 1.17 - Multiple Vulnerabilities
This plugin is prone to cross site scripting, denial of service, full path disclosure and arbitrary file upload vulnerabilities. Solution Update plugin...