CVE-2006-6888

P-News 1.16 and 1.17 store sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for db/user.dat...

CVE-2006-6891

Vz Adp Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt...

CVE-2006-6888

P-News 1.16 and 1.17 store sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for db/user.dat...

CVE-2006-6891

Vz Adp Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt...

Vz (Adp) Forum 2.0.3 - Remote Password Disclosure

Vz Adp Forum 2.0.3 - Remote Password Disclosure SvADP Forum 2.0.3 Remote Password Disclosure Vulnerablity S.name:ADP Forum Affected version:2.0.3 Download&Demo:http://www.linux.it/fedro/index.php?pag=scripts&lang=en Risk:Very Highly Critical Author:Dr Max Virus Location:Egypt POC:...

DEBIAN-CVE-2006-6614

The saveloglocal function in Fully Automatic Installation FAI 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to...

CVE-2006-6614

The saveloglocal function in Fully Automatic Installation FAI 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to...

CVE-2006-6614

The saveloglocal function in Fully Automatic Installation FAI 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to...

CVE-2006-6614

The saveloglocal function in Fully Automatic Installation FAI 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to...

CVE-2006-6614

The CVE-2006-6614 issue affects Fully Automatic Installation (FAI) 2.10.1 (and possibly 3.1.2). When verbose mode is enabled, the save_log_local function writes the root password hash to /var/log/fai/current/fai.log, and the log file’s permissions permit copying to other hosts when fai-savelog is...

CVE-2006-6377

Uploadscript 1.2 and earlier stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain the admin password hash via a direct request for /password.txt...

CVE-2006-6377

CVE-2006-6377 contributes a remote-access issue in Uploadscript 1.2 and earlier. The description states that sensitive data is stored under the web root with insufficient access control, enabling remote attackers to obtain the admin password hash by directly requesting /password.txt. The NVD note...

[Full-disclosure] Coppermine 1.4.9 SQL injection

// http://www.w4cking.com CREDIT: w4ck1ng.com PRODUCT: Coppermine 1.4.9 http://coppermine-gallery.net/ VULNERABILITY: SQL Injection NOTES: - SQL injection can be used to obtain password hash - You must be a registered user to access the vulnerable page, picmgr.php. - The table prefix must be know...

Coppermine1.4.9.txt

// http://www.w4cking.com CREDIT: w4ck1ng.com PRODUCT: Coppermine 1.4.9 http://coppermine-gallery.net/ VULNERABILITY: SQL Injection NOTES: - SQL injection can be used to obtain password hash - You must be a registered user to access the vulnerable page, picmgr.php. - The table prefix must be know...

Simplog0.9.3.1.txt

// http://www.w4cking.com CREDIT: w4ck1ng.com PRODUCT: Simplog 0.9.3.1 http://www.simplog.org/ VULNERABILITY: SQL Injection NOTES: - SQL injection can be used to obtain password hash - requires at least one blog entry POC:...

Simplog 0.9.3.1 SQL Injection

// http://www.w4cking.com CREDIT: w4ck1ng.com PRODUCT: Simplog 0.9.3.1 http://www.simplog.org/ VULNERABILITY: SQL Injection NOTES: - SQL injection can be used to obtain password hash - requires at least one blog entry POC: host/path/comments.php?op=edit&cid=120union20select209,9,9,login,...

moodle162.txt

// http://www.w4cking.com Product: moodle 1.6.2 http://www.moodle.org Vulnerability: SQL injection Notes: - SQL injection can be used to obtain password hash - the moodle blog "module" must be enabled - guest access to the blog must be enabled POC:...

SQL injection - moodle

// http://www.w4cking.com Product: moodle 1.6.2 http://www.moodle.org Vulnerability: SQL injection Notes: - SQL injection can be used to obtain password hash - the moodle blog "module" must be enabled - guest access to the blog must be enabled POC:...

trforum20.txt

!/usr/bin/perl Affected.scr..: Tr Forum V2.0 Poc.ID........: 10060903 Type..........: SQL Injection, Bypass Security Restriction Risk.level....: Medium Vendor.Status.: Unpatched Src.download..: comscripts.com/scripts/php.tr-forum.1579.html Poc.link......: acid-root.new.fr/poc/10060903.txt...

CVE-2006-3837

delcookie.php in Professional Home Page Tools Guestbook changes the expiration date of a cookie instead of deleting the cookie's value, which makes it easier for attackers to steal the cookie and obtain the administrator's password hash after logout...