2811 matches found
CVE-2007-3171
Affected software/impact: Uebimiau Webmail is vulnerable to information disclosure. The issue occurs in the demo/pop3/error.php script when an invalid value is supplied for the smarty or selected_theme parameter, which causes error messages to reveal the installation path. Root cause (as describe...
Design/Logic Flaw
PHP JackKnife PHPJK allows remote attackers to obtain sensitive information via 1 a request to index.php with an invalid value of the iParentUnq parameter, or a request to GDisplay.php with an invalid 2 iCategoryUnq or 3 sSort array parameter, which reveals the path in various error messages...
Code injection
Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account...
CVE-2007-3002
PHP JackKnife PHPJK allows remote attackers to obtain sensitive information via 1 a request to index.php with an invalid value of the iParentUnq parameter, or a request to GDisplay.php with an invalid 2 iCategoryUnq or 3 sSort array parameter, which reveals the path in various error messages...
Deserialization of untrusted data
myEvent 1.6 allows remote attackers to obtain sensitive information via 1 a Log In action without a password to login.php, or an invalid 2 view or 3 monthno parameter to myevent.php, which reveals the path in various error messages...
Design/Logic Flaw
DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages...
CVE-2007-0692
DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages...
CVE-2007-1605
CVE-2007-1605 involves w-agora 4.2.1 (Web-Agora). The connected documents describe information-disclosure via multiple vectors that reveal internal paths in error messages, triggered by crafted requests to rss.php, index.php, profile.php, and search.php using specific invalid, empty, or sensitive...
Design/Logic Flaw
sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the 1 sxMonth or 2 sxYear parameter to calendar.php, or the 3 page parameter to calendarevents.php, which reveals the path in various error messages...
CVE-2007-1236
CVE-2007-1236 affects sitex applications and concerns information disclosure through error messages produced by calendar.php (parameters sxMonth[] or sxYear[]) and calendar_events.php (parameter page[]). An attacker can craft requests with numerical values that cause error responses revealing the...
Design/Logic Flaw
shopkitplus allows remote attackers to obtain sensitive information via a request to 1 events.php with a curmonth=01 query string or 2 enc/stylecss.php with a changetheme= query string, which reveals the path in various error messages...
CVE-2007-1128
shopkitplus allows remote attackers to obtain sensitive information via a request to 1 events.php with a curmonth=01 query string or 2 enc/stylecss.php with a changetheme= query string, which reveals the path in various error messages...
CVE-2007-1128
shopkitplus allows remote attackers to obtain sensitive information via a request to 1 events.php with a curmonth=01 query string or 2 enc/stylecss.php with a changetheme= query string, which reveals the path in various error messages...
Design/Logic Flaw
Photostand 1.2.0 allows remote attackers to obtain sensitive information via a ' quote character in 1 a PHPSESSID cookie or 2 the id parameter in an article action in index.php, which reveal the path in various error messages...
CVE-2007-1102
Photostand 1.2.0 allows remote attackers to obtain sensitive information via a ' quote character in 1 a PHPSESSID cookie or 2 the id parameter in an article action in index.php, which reveal the path in various error messages...
CVE-2007-1102
Photostand 1.2.0 allows remote attackers to obtain sensitive information via a ' quote character in 1 a PHPSESSID cookie or 2 the id parameter in an article action in index.php, which reveal the path in various error messages...
CVE-2006-7000
Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to 1 email/mail.php, 2 includes/init.php, 3 certain files in includes/cron/, and 4 jpgraph.php, 5 jpgraphbar.php, 6 jpgraphpie.php, and 7 jpgraphpie3d.php in includes/graph/, which leaks the path in...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Symantec Web Security SWS before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 error messages and 2 blocked page messages produced by SWS...
CVE-2007-0563
Multiple cross-site scripting XSS vulnerabilities in Symantec Web Security SWS before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 error messages and 2 blocked page messages produced by SWS...