BEA Weblogic application server multiple vulnerabilities

Database passwords are stored unencrypted in cleartext, log files access, unauthorized MBean access, cleartext password logged on password change, etc...

CVE-2005-4015

PHP Web Statistik 1.4 does not rotate the log database or limit the size of the referer field, which allows remote attackers to fill the log files via a large number of requests, as demonstrated using pixel.php...

wagora420_xpl.txt

W-agora 4.2.0 Remote code execution / cross site scripting poc exploit software: site: http://w-agora.net/en/index.php description: "W-Agora is a web publishing and forum software. It allows you and your visitors to store and display messages, files, share discussions and other information on you...

CVE-2005-2990

AuthInfo.java in LineContol Java Client jlc before 0.8.1 stores sensitive information such as user passwords in log files...

CVE-2005-2990

CVE-2005-2990 affects the LineContol Java Client (jlc) component, where the AuthInfo.java code path in versions before 0.8.1 logs sensitive data such as user passwords. The documented impact is partial confidentiality loss. No exploitation details are provided in the sources; no explicit remediat...

XSS in GreyMatter blog

Graymatter - perl based web blog. offsite: http://www.greymatterforums.com/ GM analyze posting comments and if post contain some dangerous code like script/script, administrator get message about it in log files. Log files contain not only message, but dangerous code. When admin try to look log...

greymatterXSS.txt

Graymatter - perl based web blog. offsite: http://www.greymatterforums.com/ GM analyze posting comments and if post contain some dangerous code like , administrator get message about it in log files. Log files contain not only message, but dangerous code. When admin try to look log files Admin...

PHPMyFAQ 1.5.1 - Logs Unauthorized Access

source: https://www.securityfocus.com/bid/14930/info PHPMyFAQ is prone to an unauthorized access vulnerability. A remote attacker can exploit this vulnerability to view the application log file. This vulnerability could lead to the disclosure of various valid usernames, which could aid in brute...

CVE-2004-2414

Novell NetWare 6.5 SP 1.1, when installing or upgrading using the Overlay CDs and performing a custom installation with OpenSSH, includes sensitive password information in the 1 NIOUTPUT.TXT and 2 NI.LOG log files, which might allow local users to obtain the passwords...

CVE-2004-2414

Novell NetWare 6.5 SP 1.1 (Overlay CD installation/upgrade with OpenSSH, custom install) stores admin passwords in NIOUTPUT.TXT and NI.LOG during installation. Local users could access these log files and recover passwords, constituting an information-disclosure vulnerability. The vulnerability i...

GLSA-200508-07 : AWStats: Arbitrary code execution using malicious Referrer information

The remote host is affected by the vulnerability described in GLSA-200508-07 AWStats: Arbitrary code execution using malicious Referrer information When using a URLPlugin, AWStats fails to sanitize Referrer URL data before using them in a Perl eval routine. Impact : A remote attacker can include...

AWStats: Arbitrary code execution using malicious Referrer information

Background AWStats is an advanced log file analyzer and statistics generator. In HTTP reports it parses Referrer information in order to display the most common Referrer values that caused users to visit the website. Description When using a URLPlugin, AWStats fails to sanitize Referrer URL data...

Multiple Lantronix SecureLinx console server vulnerabilities

SSH keys and log files are accessible through Web interface. Unsfae file permissions. Directory traversal. Privilege escalations, buffer overflows...

CVE-2001-1556

The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep...

CVE-2001-1556

Technical details for CVE-2001-1556 are not publicly provided in the connected documents. Monitor for updates.

CVE-2002-2001

jmcce 1.3.8 in Mandrake 8.1 creates log files in /tmp with predictable names, which allows local users to overwrite arbitrary files via a symlink attack...

CVE-2001-1550

CVE-2001-1550 affects CentraOne 5.2 and Centra ASP when using basic authentication. The Centra Smart Connect patch CEN5.2-03 reportedly stores sensitive information in log files that are world-writable, and these log files contain a base64-encoded username and password in plaintext. A local attac...

CVE-2001-1550

CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which allows local users to obtain cleartext passwords from decoded log files and impersonate users...

CVE-2002-1694

The CVE refers to Microsoft Internet Information Server (IIS) 4.0 where log files are opened with FILE_SHARE_READ and FILE_SHARE_WRITE permissions. This shared access could allow remote attackers to modify log file contents while IIS is running, representing a potential integrity impact on logs. ...

CVE-2002-1695

Norton Internet Security 2001 opens log files with FILESHAREREAD and FILESHAREWRITE permissions, which could allow remote attackers to modify the log file contents while Norton Internet Security is running...