842 matches found
Test code in published microsoft-graph-core package exposes phpinfo()
More info at https://nvd.nist.gov/vuln/detail/CVE-2023-49283...
ownCloud graphapi Information Disclosure Vulnerability
ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo via GetPhpInfo.php, including administrative credentials...
CVE-2023-26542
Cross-Site Request Forgery CSRF vulnerability in Exeebit phpinfo WP plugin = 4.0 versions...
CVE-2023-26542
CVE-2023-26542 is a CSRF vulnerability in the WordPress plugin “phpinfo() WP” (Exeebit phpinfo() WP plugin) affecting versions
CVE-2023-26542 WordPress phpinfo() WP Plugin <= 4.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Exeebit phpinfo WP plugin = 4.0 versions...
PT-2023-20718 · WordPress · Exeebit Phpinfo() Wp
Name of the Vulnerable Software and Affected Versions: Exeebit phpinfo WP plugin versions prior to 4.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web applicatio...
CVE-2023-26542: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Exeebit phpinfo WP plugin = 4.0 versions...
WordPress Plugin phpinfo() WP Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
CVE-2023-49103
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...
CVE-2023-49103
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...
Design/Logic Flaw
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...
WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF
Description The plugin does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution. Submit the following form as a Super Admin notice that it does not contain a nonce. Despite the error,...
CVE-2023-49103: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...
ownCloud Security Breach
ownCloud is a suite of personal cloud storage solutions from the US-based company ownCloud. A security vulnerability exists in ownCloud graphapi versions prior to 0.2.1, 0.3.1 and 0.3.1. The vulnerability stems from the fact that the graphapi application relies on the third-party GetPhpInfo.php...
CVE-2023-49103
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...
WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF
Description The plugin does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution. PoC Submit the following form as a Super Admin notice that it does not contain a nonce. Despite the error...
CVE-2023-49103
The CVE-2023-49103 vulnerability affects ownCloud graphapi in versions 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The issue stems from a third‑party GetPhpInfo.php that returns a phpinfo() output, exposing the PHP environment and webserver variables (potentially including admin passwords, mail cr...
ownCloud Phpinfo Reader
Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or 0.3.0 before 0.3.1 of the app graph installed contain a test file which prints phpinfo to an unauthenticated user. A post file name must be appended to the URL to bypass the login filter. Docker m...
