Description

Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml.

Remediation

References

CVE-2015-3881

Related Vulnerabilities

WordPress Plugin WP Activity Log Security Bypass (3.3.1.1)

WordPress Plugin SEO Backdoor (5.0)

Ruby on Rails Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2014-0080)

WordPress Plugin Contact Form 7 International Sms Integration Cross-Site Scripting (1.2)

Microsoft SQL Server Remote Code Execution Vulnerability (CVE-2019-1068)

Severity

High

Classification

CVE-2015-3881 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities