CVE-2018-1053

Removed by vendor...

Two Pseudo-injection Vulnerabilities in WSTMart Frontend

WSTMart multi-user mall is a thinkphp5.0 for the core development of php multi-user B2B2C mall system. There are two pseudo-injection vulnerabilities in WSTMart frontend. An attacker can use this vulnerability to obtain database account password information...

WSTMart 'addressId' parameter has a design flaw vulnerability in Guangzhou Shangtao Information Technology Co.

WSTMart e-commerce system is based on THINKPHP 5.0 development of B2B2C integrated e-commerce system. There is a design flaw vulnerability in the WSTMart 'addressId' parameter of Guangzhou Shangtao Information Technology Co. Allow attackers to obtain database account password information...

Vimeo: CRITICAL full source code/config disclosure for Cameo

Hi! The server at https://ci.cameo.tv/ has directory listing on and seems to host quiet a few debian packages containing extremely sensitive information database paswords, API keys, you name it. One example is the config package containing 16 config files, even personal ones containing local...

DEBIAN-CVE-2013-6384

1 impldb2.py and 2 implmongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information the DB2 or MongoDB password by reading the log file...

Un-Patched PHP-CGI remote code execution vulnerability can expose Source Codes

Un-Patched PHP-CGI remote code execution bug can expose Source Codes A serious remote code execution vulnerability in PHP-CGI disclosed. PHP-CGI-based setups contain a vulnerability when parsing query string parameters from php files. The developers were still in the process of building the patch...

CVE-2008-5326

The ClearQuest Maintenance Tool in IBM Rational ClearQuest 7.0.0 before 7.0.0.4 and 7.0.1 before 7.0.1.3 on Windows allows local users to obtain 1 user and 2 database passwords by using a password revealer utility on a field containing a series of asterisks...

CVE-2004-2718

PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request...

CVE-2004-2718: Undefined Security Weakness

PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request...

CVE-2007-0151

MitiSoft stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for accessMS/MitiSoft.mdb...

CVE-2007-0149

EMembersPro 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for users.mdb...

Improper access control

CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for DataBase/Carbon2.4d.mdb...

IIS Global.asa Retrieval

This host is running the Microsoft IIS web server. This web server contains a configuration flaw that allows the retrieval of the global.asa file. This file may contain sensitive information such as database passwords, internal addresses, and web application configuration options. This...

Oracle JDeveloper Plaintext Passwords

Name Oracle JDeveloper Plaintext Passwords Systems Affected Oracle JDeveloper 9.0.4, 9.0.5, 10.1.2 Severity Low Risk Category Information Disclosure of Passwords Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 13 July 2005 V 1.00 Advisory...

Debian DSA-642-1 : gallery - several vulnerabilities

Several vulnerabilities have been discovered in gallery, a web-based photo album written in PHP4. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CAN-2004-1106 Jim Paris discovered a cross site scripting vulnerability which allows code to be inserted ...

CVE-2000-0654

Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service DTS package Registered Servers Dialog dialog, aka a variant of the "DTS Password" vulnerability...

CVE-2000-0485: Undefined Security Weakness

Microsoft SQL Server allows local users to obtain database passwords via the Data Transformation Service DTS package Properties dialog, aka the "DTS Password" vulnerability...

CVE-2000-0654

Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service DTS package Registered Servers Dialog dialog, aka a variant of the "DTS Password" vulnerability...