Gratipay: don't leak server version of grtp.co in error pages

Open the latest Firefox web browser or google chrome. Navigate to the following URL: https://grtp.co/%pa Note that the Invalid URL Encoded %pa has fired. after execution,It gives 404 error with server information and its version. I’ve tested this in the latest Firefox and Chrome...

Whitewidow - SQL Vulnerability Scanner

Whitewidow is an open source automated SQL vulnerability scanner, that is capable of running through a file list, or can scrape Google for potential vulnerable websites. It allows automatic file formatting, random user agents, IP addresses, server information, multiple SQL injection syntax, and a...

CVE-2016-1501

ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages...

U-Mail Mail System Arbitrary File Containment Vulnerability

U-mail is a mail service system. The U-Mail mail system suffers from an arbitrary file inclusion vulnerability, which allows an attacker to exploit the vulnerability to download and view arbitrary files and obtain sensitive server information...

ZeusCart 4 信息泄漏漏洞

No description provided by source. !/usr/bin/env python coding: utf-8 from urlparse import urljoin from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = '11111 ' vul ID version = '1' author = 'Disorder' vulDate =...

Multiple Flaws Exposed in Pocket Add-on for Firefox

With providing easy accessibility, the battle is not won! Server-side Vulnerabilities have been reported by a security researcher in the popular Pocket add-on that comes attached with the Firefox browser. The security flaws could have allowed hackers to exfiltrate data from the company’s servers ...

Hawkeye-G 3.0.1.4912 - Persistent Cross-Site Scripting Information Leakage

Hawkeye-G 3.0.1.4912 - Persistent Cross-Site Scripting Information Leakage Exploit Title: Persistent XSS, Information Leakage IDS / IPS Google Dork: intitle: Persistent XSS, Information Leakage IDS / IPS Date: 2015-07-25 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor...

Hawkeye-G 3.0.1.4912 Cross Site Scripting / Information Leakage

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-HAWKEYEG0725.txt Vendor: ================================ www.hexiscyber.com Product: ================================ Hawkeye-G v3.0.1.4912 Hawkeye G is an active defense...

SAP NetWeaver Portal XMLValidationComponent XXE Information Disclosure Vulnerability

SAP NetWeaver is the technology foundation for SAP Business Suite solutions, SAP xApps portfolio applications, partner solutions, and customized applications. An XXE external entity reference vulnerability exists in SAP NetWeaver Portal XMLValidationComponent, which allows remote attackers to...

Square: HTTP Header revealing server information.

Hi Square, - Vulneravility Class: OWASP A5: Security Misconfiguration - Proof of Concept: nc 74.122.190.83 80 GET / HTTP/1.1 host:1.1.1.1 HTTP/1.1 301 Moved Permanently Transfer-Encoding: chunked Connection: keep-alive Status: 301 Moved Permanently Location: https://squareup.com/ X-Powered-By:...

Nuked-Klan 1.3 - Remote Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6917/info A vulnerability has been discovered in Nuked-Klan which may be exploited to execute certain PHP functions on a target server. This issue occurs in the 'Team', 'News', and 'Lien' modules and is due to insufficien...

RealServer 5.0/6.0/7.0 Memory Contents Disclosure Vulnerability

No description provided by source. source : http://www.securityfocus.com/bid/1957/info RealServer is a popular streaming audio and video server from Real Networks. A vulnerability exists in all versions of RealServer 7 and below that could allow a remote attacker to gain administrative rights and...

IBM Net.Data 7.0 Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2017/info IBM Net.Data is a scripting language used to create web applications, it supports a wide range of language environments and is compatible with most recognized databases. Net.Data contains a vulnerability which...

Brian Dorricott MAILTO 1.0.7-9 Unauthorized Mail Server Use Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3669/info MAILTO is a program maintained by Brian Dorricott. It enables web servers to allow forms to be converted into mail messages that can be sent to numerous recipients. An issue exists in MAILTO which could allow an...

Mail.ru: Admin panel of http://tp-test1.corp.mail.ru/ is acccessible publicly

http://tp-test1.corp.mail.ru/ link has various operations which should not be accessible to an anonymous user. As admin panel is accessible an attacker can use this information in targeted attack and he can bruteforce the username and password. on the other side server information is easily...

CVE-2014-2873

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not require authentication for access to log files, which allows remote attackers to obtain sensitive server information by using a predictable name in a request for a file...

Authentication flaw

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not require authentication for access to log files, which allows remote attackers to obtain sensitive server information by using a predictable name in a request for a file...

EMC Connectrix Manager Converged Network Edition inmservlets.war FileUploadController Servlet Information Disclosure Vulnerability

This vulnerability allows remote attackers to read arbitrary files on vulnerable installations of EMC Connectrix Manager Converged Network Edition. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FileUploadController servlet which is part of...

OkCupid: Security issue in OkCupid

I come across security issue in OkCupid. OkCupid is using Components with Known Vulnerabilities. Link: http://www.okcupid.com/ Criticality level: Medium Each http response shows server information Version, which is not useful to user and browser. But same can be useful to attacker. Description :...

Kloxo SQL Injection / Remote Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Kloxo SQL Injection and Remote Code Execution', 'Description' = %q This module exploits an unauthenticated SQL injection vulnerabilit...