PT-2011-4646

Name of the Vulnerable Software and Affected Versions MicroBlog version 0.9.5 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message. For example, requesting init.ph...

PT-2011-4611

Name of the Vulnerable Software and Affected Versions concrete5 versions 5.4.0.5 through 5.4.1.1 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message. For example,...

PT-2011-4637

Name of the Vulnerable Software and Affected Versions Joomla! version 1.6.0 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by exploiting the fact that an error message reveals the installation path when accessing...

PT-2011-4615

Name of the Vulnerable Software and Affected Versions DeluxeBB version 1.3 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message. For example, a request to header...

PT-2011-4608

Name of the Vulnerable Software and Affected Versions CMS Made Simple versions 1.9.2 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message. For example, this can be...

PT-2011-4610

Name of the Vulnerable Software and Affected Versions conceptcms versions 5.3.1 through 5.3.3 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message. For example,...

PT-2011-4642

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 1.90+ build9642-20101214 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by exploiting the error message that reveals the installation path...

PT-2011-4634

Name of the Vulnerable Software and Affected Versions HTML Purifier version 4.2.0 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message. For example, this can be...

CVE-2011-3699: Exposure of Sensitive Information to an Unauthorized Actor

John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/test-active-record.php and certain other files...

CVE-2011-3703: Exposure of Sensitive Information to an Unauthorized Actor

AneCMS 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/menu/index.php and certain other files...

CVE-2011-3700: Exposure of Sensitive Information to an Unauthorized Actor

Advanced Electron Forum AEF 1.0.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by languages/english/deletetopiclang.php...

CVE-2011-3736: Exposure of Sensitive Information to an Unauthorized Actor

ExoPHPDesk 1.2.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by upgrades/upgrade9.php and certain other files...

CVE-2011-3729: Exposure of Sensitive Information to an Unauthorized Actor

dotproject 2.1.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by style/dp-grey-theme/footer.php and certain other files...

CVE-2011-3733: Exposure of Sensitive Information to an Unauthorized Actor

Elgg 1.7.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by vendors/simpletest/test/visualtest.php and certain other files...

CVE-2011-3744: Exposure of Sensitive Information to an Unauthorized Actor

HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files...

CVE-2011-3718: Exposure of Sensitive Information to an Unauthorized Actor

CMS Made Simple CMSMS 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444...

CVE-2011-3749: Exposure of Sensitive Information to an Unauthorized Actor

ka-Map 1.0-20070205 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by test.php and certain other files...

CVE-2011-3702: Exposure of Sensitive Information to an Unauthorized Actor

Ananta Gazelle 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/template.php and certain other files...

CGI Generic XPath Injection (2nd pass)

By providing specially crafted parameters to CGIs, Nessus was able to get an error from the underlying XPath engine. This error suggests that the CGI is affected by an XPath injection vulnerability. An attacker may exploit this flaw to bypass authentication or read confidential data. %NASLMINLEVE...

Better error message when viewing an embedded calendar as an unprivileged user

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-51101. panel On our site's dashboard I have a calendar macro defined as:...