3894 matches found
CVE-2007-2066
UseBB before 1.0.6 allows remote attackers to obtain sensitive information via a request with unspecified GET or POST parameters to an unspecified script, which reveals the path in an error message...
CVE-2007-1597
Unclassified NewsBoard 1.6.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain 1 the board log via a direct request for logs/board-YYYY-MM-DD.log, 2 the mail and private message PM log via a direct request for...
Design/Logic Flaw
w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the 1 bn array parameter to index.php, which expects a string, and 2 certain parameters to deleteforum.php, which displays the path name in the resulting error message...
Design/Logic Flaw
WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error message...
CVE-2007-1409
WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error message...
CVE-2006-7149
Multiple cross-site scripting XSS vulnerabilities in Mambo 4.6.x allow remote attackers to inject arbitrary web script or HTML via 1 the query string to a index.php, which reflects the string in an error message from modlogin.php; and the 2 mcname parameter to b moscomment.php and c comcomment.ph...
CVE-2007-0894
MediaWiki before 1.9.2 allows remote attackers to obtain sensitive information via a direct request to 1 Simple.deps.php, 2 MonoBook.deps.php, 3 MySkin.deps.php, or 4 Chick.deps.php in wiki/skins, which shows the installation path in the resulting error message...
CVE-2006-2219
phpBB 2.0.20 does not verify user-specified input variable types before being passed to type-dependent functions, which allows remote attackers to obtain sensitive information, as demonstrated by the 1 mode parameter to memberlist.php and the 2 highlight parameter to viewtopic.php that are used a...
CVE-2006-2220
phpBB 2.0.20 does not properly verify user-specified input variables used as limits to SQL queries, which allows remote attackers to obtain sensitive information via a negative LIMIT specification, as demonstrated by the start parameter to memberlist.php, which reveals the SQL query in the...
ColdFusion crossite scripting
User-Agent field from HTTP request is used unfiltered in error message text. It's possible to manipulate client's User-Agent field through Flash...
CVE-2007-0597
Aztek Forum 4.00 allows remote attackers to obtain sensitive information via a direct request to forum.php with the fid=XD query string, which reveals the path in an error message...
CYBSEC - Security Advisory: SAP Internet Graphics Service (IGS) Remote Buffer Overflow
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSEC-SecurityPre-AdvisorySAPIGSRemoteBufferOverflow.pdf This advisory contains the full-detailed information regarding the vulnerability described in...
CVE-2007-0259
Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to obtain sensitive information via an invalid cat parameter to boxx/knowledgebase.asp, which reveals the path in an error message...
Information disclosure
admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MKPATH=1 query string, which reveals the path in an error message...
CVE-2007-0194
admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MKPATH=1 query string, which reveals the path in an error message...
WordPress Charset解抹SQL注入漏洞
WordPress是一款流行的网络日记程序。 WordPress处理字符集解码存在问题，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 在当PHP的mbstring扩展激活时，WordPress支持使用不同字符集解码Trackback，因为解码发送在数据库为输入数据执行选择正确的字符集之前，因此允许绕过针对SQL注入的保护。 为了演示需要，Stefan Esser建议使用UTF-7字符集来利用，因为其他的多字节字符集允许多字节序列以''结尾。...
Information disclosure
phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblueorange/layout.inc.php, which reveals the path in an error message...
CVE-2007-0095
phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblueorange/layout.inc.php, which reveals the path in an error message...
Important openoffice.org security update
1.1.5-6 - ensure correct permissions 1.1.5-5 - Resolves: rhbz217347 CVE-2006-5780 WMF heap overflow ooo70042 Known Issue: bz 2005: May get kde error message when exiting ooimpress and oodraw appears to be an existing problem See http://bugzilla.oracle.com for more details...