EUVD-2006-0378

Malware in sbrugna...

Improper access control

Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes...

CVE-2006-0371

Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly including one that stores the administrator's account name and password, via a .. dot dot in the post parameter...

CVE-2006-0370

Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes...

CVE-2006-0370

Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes...

CVE-2006-0371

CVE-2006-0371 concerns RCBlog 1.03 (PHP) where index.php accepts a post parameter that is not properly sanitized, enabling a directory traversal attack. An attacker can use a .. in the post parameter to read arbitrary .txt files on the remote host, potentially exposing sensitive data such as the ...

CVE-2006-0370: Undefined Security Weakness

Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes...

CVE-2006-0371: Undefined Security Weakness

Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly including one that stores the administrator's account name and password, via a .. dot dot in the post parameter...