4685 matches found
CVE-2005-2546
Arab Portal 2.0 allows remote attackers to obtain sensitive information via a long 1 username or 2 password, which reveals the path in an error message when the undefined "errmsg" function is called...
CVE-2005-2474
ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to 1 PersonView.php, 2 MemberRoleChange.php, 3 PropertyAssign.php, 4 WhyCameEditor.php, 5 GroupPropsEditor.php, 6 Reports/PDFLabel.php, or 7 UserDelete.php, an invalid Number parameter to 8...
CVE-2005-2477
shopdisplayproducts.php in Naxtor Shopping Cart 1.0 allows remote attackers to obtain sensitive information via a catid with a "'" single quote, which reveals the path in an error message, possibly due to an SQL injection vulnerability...
CVE-2002-2094: Observable Discrepancy
Joe Testa hellbent 01 allows remote attackers to determine the full path of the web root directory via a GET request with a relative path that includes the root's parent, which generates a 403 error message if the parent is incorrect, but a normal response if the parent is correct...
CVE-2004-2296
The previewreview function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message...
CVE-2005-2436
CVE-2005-2436 affects Website Baker Project. Affected functionality: browse.php allows remote disclosure of sensitive data. Root cause: error messages reveal the filesystem path when accessing (1) a non-existent dir parameter value or (2) direct requests to certain PHP files. Impact: partial conf...
CVE-2005-2433
PhpList allows remote attackers to obtain sensitive information via a direct request to 1 about.php, 2 connect.php, 3 domainstats.php or 4 usercheck.php in publichtml/lists/admin directory, 5 attributes.php, 6 dbcheck.php, 7 importcsv.php, 8 user.php, 9 usermgt.php, or 10 users.php in...
CVE-2005-2423
Technical details are not publicly available in the provided documents. Monitor for updates from official advisories to obtain affected products, vulnerable components, impact, and remediation.
CVE-2005-2436: Undefined Security Weakness
browse.php in Website Baker Project allows remote attackers to obtain sensitive data via 1 a directory that does not exist in the dir parameter or 2 a direct request to certain php files, which reveal the path in an error message...
CVE-2005-2433: Undefined Security Weakness
PhpList allows remote attackers to obtain sensitive information via a direct request to 1 about.php, 2 connect.php, 3 domainstats.php or 4 usercheck.php in publichtml/lists/admin directory, 5 attributes.php, 6 dbcheck.php, 7 importcsv.php, 8 user.php, 9 usermgt.php, or 10 users.php in...
CVE-2005-2423: Undefined Security Weakness
Beehive Forum allows remote attackers to obtain sensitive information via 1 an invalid finaluri or sortby parameter to index.php or a direct request to 2 admin.php, 3 attachments.inc.php, 4 banned.inc.php, 5 beehive.inc.php, 6 constants.inc.php, 7 db.inc.php, 8 dictionary.inc.php or 9...
CVE-2005-2381: Undefined Security Weakness
PHP Surveyor 0.98 allows remote attackers to obtain sensitive information via a direct request to 1 question.php, 2 survey.php, or 3 group.php in the root directory, a direct request to 4 database.php, 5 sessioncontrol.php, 6 html.php, 7 sessioncontrol.php, an invalid 8 qid parameter to...
CVE-2005-2289
PHPCounter 7.2 allows remote attackers to obtain sensitive information via a direct request to prelims.php, which reveals the path in an error message...
CVE-2002-2009: Undefined Security Weakness
Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by 1 +/, 2 /, 3 , and 4 %20/, which leaks the pathname in an error message...
FreeBSD : cups-lpr -- lppasswd multiple vulnerabilities (7850a238-680a-11d9-a9e7-0001020eed82)
D. J. Bernstein reports that Bartlomiej Sieka has discovered several security vulnerabilities in lppasswd, which is part of CUPS. In the following excerpt from Bernstein's email, CVE names have been added for each issue : First, lppasswd blithely ignores write errors in fputsline,outfile at lines...
FreeBSD : phpmyadmin -- information disclosure vulnerability (a7062952-9023-11d9-a22c-0001020eed82)
A phpMyAdmin security announcement reports : By calling some scripts that are part of phpMyAdmin in an unexpected way especially scripts in the libraries subdirectory, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmi...
CVE-2005-2110
WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via 1 a direct request to menu-header.php or a "1" value in the feed parameter to 2 wp-atom.php, 3 wp-rss.php, or 4 wp-rss2.php, which reveal the path in an error message. NOTE: vector 1 was later reported to al...
CVE-2005-2110
WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via 1 a direct request to menu-header.php or a "1" value in the feed parameter to 2 wp-atom.php, 3 wp-rss.php, or 4 wp-rss2.php, which reveal the path in an error message. NOTE: vector 1 was later reported to al...
CVE-2004-2150
The CVE-2004-2150 entry concerns Nettica Corporation INTELLIPEER Email Server 1.01, which discloses account validity through differing error messages. Related sources (PT-2004-3045 and Nessus entries) describe remote authentication attempts revealing whether an account exists, enabling user enume...