1287 matches found
CVE-2005-2489
Web Content Management News System allows remote attackers to create arbitrary accounts and gain privileges via a direct request to Admin/Users/AddModifyInput.php...
CVE-2005-2433
PhpList allows remote attackers to obtain sensitive information via a direct request to 1 about.php, 2 connect.php, 3 domainstats.php or 4 usercheck.php in publichtml/lists/admin directory, 5 attributes.php, 6 dbcheck.php, 7 importcsv.php, 8 user.php, 9 usermgt.php, or 10 users.php in...
CVE-2005-2286
WebEOC before 6.0.2 does not properly check user authorization, which allows remote attackers to gain privileges via a direct request to a resource...
CVE-2005-2289
PHPCounter 7.2 allows remote attackers to obtain sensitive information via a direct request to prelims.php, which reveals the path in an error message...
CVE-2005-1995
Bitrix Site Manager 4.0.x allows remote attackers to obtain sensitive information via direct request to 1 subscrform.php or 2 dbqueryerror.php, which reveals the path in an error message...
CVE-2005-1954
singapore 0.9.11 allows remote attackers to obtain sensitive information via a direct request to 1 admin.class.php, 2 any .tpl.php file in templates/admindefault/, or 3 any .tpl.php file in templates/default/, which reveal the path in an error message...
CVE-2005-2005
Ultimate PHP Board UPB 1.9.6 GOLD and earlier stores the users.dat file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information on registered users via a direct request to db/users.dat...
CVE-2005-1685
episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp...
CVE-2005-1733
Cookie Cart stores the password file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and encrypted passwords via a direct request to passwd.txt...
CVE-2005-1668
YusASP Web Asset Manager 1.0 allows remote attackers to gain privileges via a direct request to assetmanager.asp...
CVE-2005-1601
MRO Maximo Self Service 4 and 5 stores certain information under the web document root using file extensions that are not processed by Tomcat, which allows remote attackers to obtain sensitive information via a direct request for the file, such as MXServer.properties...
CVE-2005-1595
CodeThat ShoppingCart 1.3.1 stores config.ini under the web root, which allows remote attackers to obtain sensitive information via a direct request...
CVE-2005-1552
GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0, when set to create JPEG images, does not properly protect an image even when a password and username is assigned, which may allow remote attackers to gain sensitive information via a direct request to the image...
CVE-2005-1501
MidiCart PHP Shopping Cart allows remote attackers to obtain sensitive information via a direct request to 1 searchlist.php, 2 itemlist.php, or 3 itemshow.php, which reveal the path in a PHP error message...
CVE-2004-1994
FuseTalk 4.0 allows remote attackers to ban other users via a direct request to banning.cfm...
CVE-2004-2060
ASPRunner 2.4 stores the database under the web root in the db directory, which may allow remote attackers to obtain the database via a direct request to the database filename, which is predictable based on table and field names...
CVE-2005-1422
Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to conduct administrator operations and cause a denial of service server or camera shutdown via a direct request to admin.html...
CVE-2005-1028
PHP-Nuke 6.x through 7.6 allows remote attackers to obtain sensitive information via a direct request to 1 index.php with the forumadmin parameter set, 2 the Surveys module, or 3 the YourAccount module, which reveals the path in a PHP error message...