1020 matches found
People Directory search can be misused to retrieve email addresses of all users
Even when email addresses should be hidden because of global settings, it is possible to retrieve email addresses of all the users in the system by misusing search in people directory. It seems that the email address is one of the attributes that are being indexed by the search engine. So if one...
JVN#08951968 MailDwarf vulnerability allows unauthorized sending of emails
Impact A remote attacker may be able to send unsolicited mails to arbitrary email addresses. Solution Products Affected MailDwarf ver3.01 or earlier...
Moodle 'moodledata/sessions' Session Files Remote Information Disclosure
The version of Moodle on the remote host allows a remote attacker to browse session files, which likely contain sensitive information about users of the application, such as password hashes and email addresses. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
CVE-2007-1179
WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to 1 the Recommend feature, Email Article 2 senders and 3 recipients, 4 New User Approval, 5 Edit Profiles, 6 the Newsletter Subscription form, 7 the Recommend form, and 8 sending of articles, which has...
CVE-2007-1179
WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to 1 the Recommend feature, Email Article 2 senders and 3 recipients, 4 New User Approval, 5 Edit Profiles, 6 the Newsletter Subscription form, 7 the Recommend form, and 8 sending of articles, which has...
CVE-2006-6866
This CVE concerns STphp EasyNews PRO 4.0, where sensitive data is stored under the web root with insufficient access control. The vulnerability allows remote attackers to retrieve usernames, email addresses, and password hashes via a direct request for data/users.txt. The root cause is inadequate...
CVE-2006-6866
STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, email addresses, and password hashes via a direct request for data/users.txt...
Debian DSA-1236-1 : enemies-of-carlotta - missing sanity checks
Antti-Juhani Kaijanaho discovered that enemies-of-carlotta, a simple manager for mailing lists, does not properly sanitise email addresses before passing them through to the system shell. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...
Easy File Sharing Web Server 4 - Remote Information Stealer
Easy File Sharing Web Server 4 - Remote Information Stealer / =================================================================== 0-day Alternative File Stream Exploit for Easy File Share Server 4 =================================================================== Exploit allows malicious users t...
JVN#11048526 mail f/w system vulnerable to allow unauthorized email transmissionk
Impact A remote attacker may exploit this vulnerability to send unsolicited mails to arbitrary email addresses. Solution Products Affected mail f/w system 8.2 and earlier...
CVE-2006-3958
Multiple unspecified cross-site scripting XSS vulnerabilities in Taskjitsu 2.0.3 allow remote attackers to inject arbitrary web script or HTML via 1 the Search Tasks system, or authenticated users via 2 the Edit Task system, 3 the back-end Category Editor system, and 4 "Pages that display task...
CVE-2006-3483
PHPMailList 1.8.0 stores sensitive information under the web document root iwth insufficient access control, which allows remote attackers to obtain email addresses of subscribers, configuration information, and the admin username and password via direct requests to 1 list.dat or 2 mlconfig.dat...
CVE-2006-3483
PHPMailList 1.8.0 stores sensitive information under the web document root iwth insufficient access control, which allows remote attackers to obtain email addresses of subscribers, configuration information, and the admin username and password via direct requests to 1 list.dat or 2 mlconfig.dat...
Hiox Guestbook 3.1
Hiox Guestbook 3.1 Homepage: http://hscripts.com/scripts/php/gb.php Description A free guest book script that can be added in to any html website with php. Effected files: index.php Exploit: The input forms for signing the guestbook arent sanatized properally. This could lead users to insert...
CVE-2006-2422
phpCOIN 1.2.3 and earlier stores messages based upon e-mail addresses, which allows remote authenticated users to read messages for other users by adding the sender's e-mail address as an "additional contact"...
CVE-2006-0114
The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contactid parameter to index2.php...
CVE-2005-3338
Unspecified vulnerability in Mantis before 0.19.3, when using reminders, causes Mantis to display the real email addresses of users...
CVE-2005-3338
Unspecified vulnerability in Mantis before 0.19.3, when using reminders, causes Mantis to display the real email addresses of users...
CVE-2005-3338
CVE-2005-3338 affects MantisBT prior to version 0.19.3. The vulnerability occurs when using reminders, which causes the system to display the real, non-hidden email addresses of users, exposing confidential contact information. The disclosed information is limited to email addresses (partial conf...