CVE-2007-0375

Joomla! 1.5.0 Beta is affected by CVE-2007-0375. Remote attackers can obtain sensitive information by directly requesting specific PHP scripts (e.g., plugins/user/example.php, gmail.php, example.php, ldap.php in plugins/authentication; modules/mod_mainmenu/menu.php). The root cause is a jimport f...

Design/Logic Flaw

BMC Remedy Action Request System 5.01.02 Patch 1267 generates different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to determine valid account names...

CVE-2007-0310

The CVE-2007-0310 entry concerns BMC Remedy Action Request System 5.01.02 Patch 1267. The vulnerability arises because login error messages differ between valid‑username and invalid‑username attempts, allowing remote attackers to enumerate valid account names. Impact stated: attacker can determin...

Remedy Action Request System 5.01.02 - User Enumeration

======================================================= Remedy Action Request System User Enumeration ======================================================= Davide Del Vecchio Adv11 Discovered in: 08/01/2007 Version affected: Remedy Action Request System 5.01.02 Patch 1267. The same vulnerable...

CVE-2007-0195

CVE-2007-0195 affects F5 FirePass 5.4–5.5.1 and 6.0. The issue is that authentication error messages differ between valid and invalid usernames, enabling remote attackers to confirm the existence of LDAP accounts. The connected documents confirm the affected product/versions and the exploitation ...

CVE-2007-0109

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2007-0109

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2007-0109

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2006-6886

phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for 1 files.public-userroot.inc.php or 2 files.private.additions.inc.php in include/inclib/, which reveals the path in various error messages...

CVE-2006-6682

CVE-2006-6682 affects chetpasswd 2.3.3. The vulnerability arises from a discrepancy in error messages when authenticating with a valid username versus an invalid one, enabling remote attackers to enumerate valid usernames on the target system. The provided documents confirm the issue and its impa...

TorrentFlux 2.2 - downloaddetails.php Local File Disclosure

TorrentFlux 2.2 - downloaddetails.php Local File Disclosure Description: TorrentFlux fails to sanitise the variable "alias" in downloaddetails.php. This allows an attacker to include any file they want; the contents is displayed at in the spaces provided and the remaning data is displayed as erro...

TorrentFlux 2.2 (downloaddetails.php) Local File Disclosure Exploit

No description provided by source. Description: TorrentFlux fails to sanitise the variable "alias" in downloaddetails.php. This allows an attacker to include any file they want; the contents is displayed at in the spaces provided and the remaning data is displayed as error messages on the page...

CVE-2006-6119

mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation path in various error messages...

CVE-2006-6119

mmgallery 1.55 contains an information disclosure vulnerability where a direct request to thumbs.php allows remote attackers to view error messages that reveal the installation path. This CVE (CVE-2006-6119) is documented with a CVSS v2 base score of 5.0 (Medium) and a network attack vector with ...

CVE-2006-6119

mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation path in various error messages...

Moderate: Red Hat Security Advisory: nss_ldap security update

Updated nssldap packages that fix a security flaw are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. nssldap is a set of C library extensions that allow X.500 and LDAP directory servers to be used ...

DEBIAN-CVE-2006-5718

Cross-site scripting XSS vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter...

XSession race conditions

Race conditions allows different user to see error messages...

USN-364-1: Xsession vulnerability

A race condition existed that would allow other local users to see error messages generated during another user's X session. This could allow potentially sensitive information to be leaked...

CVE-2006-5109

Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for 1 linknavi.php or 2 spotlight.php, which reveals the path in various error messages. NOTE: the information.php, language.php, listdocs.php, popularprod.php, sale.php, checksum.php, and...