4338 matches found
CVE-2007-3079
listmembers.php in EQdkp 1.3.2c and earlier allows remote attackers to obtain sensitive information via an invalid compare parameter, which reveals the path...
CERN İmage Map Dispatcher
CERN Image Map Dispatcher /cgi-bin/htimage.exe comes by default with FrontPage. I found three bugs in "htimage.exe": 1 Gives us the full path to the root directory 2 Simple buffer overflow 3 Allow us to access files. Problem 1 Like I said, the first bug gives us the full path to the root director...
CACTUSHOP 6 Default Installation Allows Remote Database Disclosure
Cactushop V6 allows remote users to download the database which contains creditcard numbers and critical information. The affected carts default installation gives away the path to database file. As a result, an attacker exploiting this vulnerability will be able to obtain detailed private custom...
[Full-disclosure] Full Path Disclosure eqDKP 1.3.2c and prior
eqDKP 1.3.2c and prior 'compare' variable reveals the full path because eqdkp fails to properly sanitize user-supplied input Example: /path-to-eqdkp/listmembers.php?compare=00 Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored b...
PHP JackKnife [multiple vulnerabilities]
Vendor site: http://www.phpjk.com/ Product: phpjackknife Bug: sql injection , xss , full path Risk: high Note: works regarless of php.ini settings Description: PHP JackKnife PHPJK is freely downloadable PHP gallery software that you can use to instantly create you own online web gallery Injection...
Full Path Disclosure in SendCard
Hello Vulnerable : SendCard Version : 3.3.0 Web : http://www.sendcard.org Exploit : http://example.com/sendcard/sendcard.php?sclanguage='Anything' -------------------- Discovered By LinuxDrox www.LeZr.Com Best Regards ,,,...
wanewsletter-rfi.txt
======================= S==A==U==D==I ======================== WAnewsletter-2.1.3 newsletter.php RFI Vul ============================================================== Found By : Mogatil , [email protected] ============================================================== Script Site :...
Full Path Disclosure in Almnzm
Hello Vulnerable : Almnzm Web : http://www.almnzm.com Exploit : http://example.com/almnzm/index.php?action=activateorder&orderid='Anything' -------------------- Discovered By LinuxDrox www.LeZr.Com Best Regards ,,,,...
DGNews version 2.1 Path Disclosure Vulnerability
netVigilance Security Advisory 21 DGNews version 2.1 Path Disclosure Vulnerability Description: DGNews is small and simple but powered news publishing. Easy installation, no programing required. But you can still change whatever you want for advanced users. Features: add unlimited categories,...
[Full-disclosure] Uebimiau Webmail Multiple Vulnerabilities
Synopsis: Multiple Vulnerabilities Introduction: Uebimiau is an open source webmail interface. Details: Uebimiau doesn't correctly handle the $GET array in error.php. Many vulnerabilities have been already discovered, but I would like to introduce few new ones: 1 XSS 2 Three Web Server Directory...
myEvent version 1.6 Multiple Path Disclosure Vulnerabilities
netVigilance Security Advisory 24 myEvent version 1.6 Multiple Path Disclosure Vulnerabilities Description: myEvent is Dynamic Calendar based Events Management system with admin panel for adding events, edit and delete built using PHP & mySQL. Display today's event and future events links on the...
CVE-2007-2780
CVE-2007-2780 affects PsychoStats 3.0.6b and earlier. The issue is an information disclosure vulnerability where a remote attacker can trigger a request to server.php with a missing or invalid newtheme parameter and receive an error message that reveals a path. Base CVSS v2 score is 5.0 (Network,...
[Full-disclosure] Jetbox CMS version 2.1 Multiple Path Disclosure Vulnerabilities
netVigilance Security Advisory 27 Jetbox CMS version 2.1 Multiple Path Disclosure Vulnerabilities Description: Jetbox CMS is seriously tested on usability & has a professional intuitive interface. The system is role based, with workflow and module orientated. All content is fully separated from...
PsychoStats 2.3 - Server.php Full Path Disclosure
PsychoStats 2.3 - Server.php Full Path Disclosure source: https://www.securityfocus.com/bid/24039/info PsychoStats is prone to a path-disclosure issue when invalid data is submitted. Exploiting this issue can allow an attacker to access sensitive data that may be used to launch further attacks...
PsychoStats 2.3 - 'Server.php' Full Path Disclosure
source: https://www.securityfocus.com/bid/24039/info PsychoStats is prone to a path-disclosure issue when invalid data is submitted. Exploiting this issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer. PsychoStats 3.0.6b an...
CVE-2007-2441
CVE-2007-2441 affects Caucho Resin Professional 3.1.0 and earlier for Windows. The vulnerability allows remote attackers to obtain the system path via specific URLs related to deploying web applications or displaying .xtp files, i.e., a path-disclosure/vector issue in Resin 3.1.x. The connected s...
Caucho Resin 3.1 - Encoded Space Request Full Path Disclosure
source: https://www.securityfocus.com/bid/23985/info Caucho Resin is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data. Attackers can exploit these issues to access potentially sensitive data that may aid in further attacks. Resin...
Caucho Resin 3.1 - Encoded Space Request Full Path Disclosure
Caucho Resin 3.1 - Encoded Space Request Full Path Disclosure source: https://www.securityfocus.com/bid/23985/info Caucho Resin is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data. Attackers can exploit these issues to access...
CVE-2007-2669
Multiple cross-site scripting XSS vulnerabilities in PHPChain 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the catid parameter to 1 settings.php or 2 cat.php. NOTE: certain parameter values also trigger path disclosure...