CVE-2006-7062

calendar.php in Kamgaing Email System kmail 2.3 and earlier allows remote attackers to obtain the full path of the server via an invalid d parameter, which leaks the path in an error message...

CVE-2006-7062

CVE-2006-7062 affects Kamgaing Email System (kmail) version ≤ 2.3. The vulnerability in calendar.php arises from handling an invalid d parameter, causing an error message that leaks the server’s full filesystem path. This is an information disclosure (remote, network-based) with a CVSS v2 base sc...

CVE-2006-7060

The CVE-2006-7060 entry concerns the Scriptsez.net E-Dating System, specifically the file/component cindex.php. Affected behavior is a remote disclosure where an invalid id parameter in a dologin action causes an error message that reveals the full filesystem path, leading to potential informatio...

CVE-2006-7000

Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to 1 email/mail.php, 2 includes/init.php, 3 certain files in includes/cron/, and 4 jpgraph.php, 5 jpgraphbar.php, 6 jpgraphpie.php, and 7 jpgraphpie3d.php in includes/graph/, which leaks the path in...

CVE-2006-7000

Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to 1 email/mail.php, 2 includes/init.php, 3 certain files in includes/cron/, and 4 jpgraph.php, 5 jpgraphbar.php, 6 jpgraphpie.php, and 7 jpgraphpie3d.php in includes/graph/, which leaks the path in...

MediaWiki Full Path Disclosure Vulnerability

Vendor: MediaWiki Vulnerable: MediaWiki 1.9.1 and below Bugtraq ID: Secunia Advisory: Release Date: 2007-01-29 Full Path Disclosure This vulnerability affects all the default skins: http://www.example.com/wiki/skins/Simple.deps.php http://www.example.com/wiki/skins/MonoBook.deps.php...

Opera security advisory 2004-12-10 – Opera Security Advisories

Opera security advisory 2004-12-10 – Opera Security Advisories OPCOM Team | February 9, 2007 Opera security advisory Named frames or windows can be hi-jacked by malicious frames or windows. Periods in the file name and non-breaking spaces in the Content-Type header can make the save/open dialog...

joomla150beta-sql.txt

Hi, These bugs were published in full-disclosure about 2 weeks ago CVE : CVE-2007-0373, CVE-2007-0374 and CVE-2007-0375, CVE-2007-0387 . In Mambo 4.6.1 and Joomla 1.0.11 and 1.5 Beta , the 'id' parameter can cause sql injection when cancelling content editting . Other versions maybe affected too...

Design/Logic Flaw

Aztek Forum 4.00 allows remote attackers to obtain sensitive information via a direct request to forum.php with the fid=XD query string, which reveals the path in an error message...

Discuz[0day]remote include vulnerabilities-vulnerability warning-the black bar safety net

discuz Forum, the Trevi Fountain plug in the DZ root directory there is a wish. php file,file fourth line: require $discuzroot.'./ include/discuzcode.func.php'; Obviously the program does not do any filtering,a full remote include vulnerability,the specific use of the method is very simple:...

Aztek Forum 4.1 Multiple Vulnerabilities Exploit

No description provided by source. !/usr/bin/php AztekForum4.1MultipleVulnerabilitiesExploit header================================================== sploitOwner-root statusTryingtoregisteranewuser sploitLogin/Password-phpsploit8435 statusTryingtogetdatabaseinformations...

Aztek Forum 4.0 Multiple Vulnerabilities Exploit

Exploit for unknown platform in category web applications ================================================ Aztek Forum 4.0 Multiple Vulnerabilities Exploit ================================================ !/usr/bin/php Aztek Forum 4.1 Multiple Vulnerabilities Exploit header...

Full Path Disclosure in Open-Realty ( v2.3.4 )

Hello Vulnerable : Open-Realty Verision : 2.3.4 Web : http://www.open-realty.org Exploit : http://www.example.com/script/index.php?action=listingview&listingID='anything' -------------------- Discoverey By LinuxDrox www.LeZr.Com/vb Best Regards ,,,,...

DEBIAN-CVE-2006-6943

PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to a scripts/checklang.php and b themes/darkblueorange/layout.inc.php; and via the 1 lang, 2 target, 3 db, 4 goto, 5 table, and 6 tblgroup array arguments to c index.php, and the 7 back argument t...

CVE-2006-6943

PhpMyAdmin prior to 2.9.1.1 is affected by a path-disclosure vulnerability. Remote attackers can obtain the full server path by making direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php, as well as by supplying any of the following arguments to index.php: ...

WordPress <= 2.0.6 - Full Path disclosure

Because of this vulnerability, the attackers can obtain sensitive information via an invalid m parameter. Solution Update the WordPress to the latest available version at least 2.0.7...

XSS and Path Disclosure vulnerabilities

PMASA-2007-2 Announcement-ID: PMASA-2007-2 Date: 2007-01-16 Summary XSS and Path Disclosure vulnerabilities Description We received an advisory from Laurent Gaffié and we wish to thank him for his work. It was possible to trigger these attacks on dbcreate.php and index.php. Severity We consider...

ezboxxezroot.txt

Ezboxx multiple vulnerabilities. Vulnerable version: Ezboxx Portal System Beta v 0.7.6 and below. The Ezboxx Portal System Beta v 0.7.6 and below versions are vulnerable to Cross-site scripting, Path disclosure and SQL Injection attacks. Cross-site scripting: ---------------------- Description:...

CVE-2007-0194

admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MKPATH=1 query string, which reveals the path in an error message...

Ezboxx multiple vulnerabilities.

Ezboxx multiple vulnerabilities. Vulnerable version: Ezboxx Portal System Beta v 0.7.6 and below. The Ezboxx Portal System Beta v 0.7.6 and below versions are vulnerable to Cross-site scripting, Path disclosure and SQL Injection attacks. Cross-site scripting: ---------------------- Description:...