CVE-2006-0700

imageVue 16.1 allows remote attackers to obtain folder permission settings via a direct request to dir.php, which returns an XML document that lists folders and their permissions...

Path traversal

MyTopix 1.2.3 allows remote attackers to obtain the installation path via a direct request to logon.mod.php, which leaks the path in an error message...

CVE-2006-0327

TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to 1 thumbs.php, 2 showpic.php, or 3 tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails...

Design/Logic Flaw

TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to 1 thumbs.php, 2 showpic.php, or 3 tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails...

CVE-2006-0327

TYPO3 3.7.1 is affected by a path/information disclosure vulnerability triggered by direct requests to thumbs.php, showpic.php, or tables.php. The root cause is an incorrect variable definition that causes the requested path to be revealed in an error message when a require() call fails. The CVE ...

CVE-2006-0327

TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to 1 thumbs.php, 2 showpic.php, or 3 tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails...

CVE-2006-0174

Hummingbird Collaboration aka Hummingbird Enterprise Collaboration 5.21 and earlier allows remote attackers to obtain sensitive information intranet IP addresses and enumerations of valid parameter values via a direct request to hc, which reveals the information in an error message or a cookie...

Information disclosure

boastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php and 2 sidemenu.php, which reveals the path in an error message...

CVE-2005-4657

Ocean12 Calendar Manager Pro 1.01 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to /admin/view.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

DEBIAN-CVE-2005-4463

WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to 1 wp-includes/vars.php, 2 wp-content/plugins/hello.php, 3 wp-admin/upgrade-functions.php, 4 wp-admin/edit-form.php, 5 wp-settings.php, and 6 wp-admin/edit-form-comment.php, which leaks the path ...

CVE-2005-4358

admin/admindisallow.php in phpBB 2.0.18 allows remote attackers to obtain the installation path via a direct request with a non-empty setmodules parameter, which causes an invalid appendsid function call that leaks the path in an error message...

CVE-2005-4320

Limbo CMS 1.0.4.2 and earlier allows remote attackers to obtain the installation path of the application via a direct request to 1 doc.inc.php, 2 element.inc.php, and 3 node.inc.php, which leaks the path in an error message...

CVE-2005-3979

relocateserver.php in Coppermine Photo Gallery CPG 1.4.2 and 1.4 beta is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request...

CVE-2005-3979

relocateserver.php in Coppermine Photo Gallery CPG 1.4.2 and 1.4 beta is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request...

CVE-2004-2575

phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to 1 hookadmin.inc.php, 2 hookhome.inc.php, 3 class.holidaycalc.inc.php, and 4 setup.inc.php.sample, which reveals the path in an error message...

CVE-2005-2897

WEB//NEWS 1.4 allows remote attackers to obtain sensitive information via a direct request to files in the actions directory, which reveal the path in an error message, as demonstrated using cat.add.php...

CVE-2005-2897

In CVE-2005-2897, WEB//NEWS 1.4 is vulnerable to information disclosure: remote attackers can obtain sensitive information by directly requesting files in the actions directory, with the error message revealing the file path (illustrated by cat.add.php). NVD lists a base score of 5.0 (Medium) wit...

CVE-2005-2897

WEB//NEWS 1.4 allows remote attackers to obtain sensitive information via a direct request to files in the actions directory, which reveal the path in an error message, as demonstrated using cat.add.php...

CVE-2005-2576

CaLogic 1.22 (and possibly earlier) is affected by CVE-2005-2576. A remote attacker can cause an information disclosure by requesting any of the following endpoints: doclsqlres.php, clmcpreload.php, viewhistlog.php, mcconfig.php, doclsqlbak.php, defcalsel.php, or cl_minical.php. The vulnerability...

CVE-2005-2576

CaLogic 1.22, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to 1 doclsqlres.php, 2 clmcpreload.php, 3 viewhistlog.php, 4 mcconfig.php, 5 doclsqlbak.php, 6 defcalsel.php, or 7 clminical.php, which reveals the path in an error message...