Justice Guestbook 1.3 vulnerabilities

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: Justice Guestbook 1.3 vulnerabilities product: Justice Guestbook 1.3 vendor: http://www.justice-media.de risk: high date: 03/29/2k3 discovered by: euronymous /F0KP advisory urls: http://f0kp.iplus.ru/bz/017.en.txt...

Justice Guestbook 1.3 - Full Path Disclosure

Justice Guestbook 1.3 - Full Path Disclosure source: https://www.securityfocus.com/bid/7234/info A path disclosure vulnerability has been reported for Guestbook. The issue occurs when a request is made to the cfooter.php3 PHP script page. Access to sensitive filesystem information may aid an...

Justice Guestbook 1.3 - Full Path Disclosure

source: https://www.securityfocus.com/bid/7234/info A path disclosure vulnerability has been reported for Guestbook. The issue occurs when a request is made to the cfooter.php3 PHP script page. Access to sensitive filesystem information may aid an attacker in launching further attacks against a...

ScozBook 1.1 - Full Path Disclosure

source: https://www.securityfocus.com/bid/7236/info A path disclosure vulnerability has been reported for ScozBook. The issue occurs when a request is made to the view.php script page. Access to sensitive filesystem information may aid an attacker in launching further attacks against a target...

PostNuke Sensitive Information Disclosure

Title: PostNuke path disclosure, and... db name. Version: 0.7.2.3-Phoenix other Problem: A vulnerability have been found in Postnuke v0.7.2.3-Phoenix which allow users to determine the physical path of this cms. This vulnerability would allow a remote user to determine the full path to the web ro...

PostNuke 0.72x Stats Module - Full Path Disclosure

PostNuke 0.72x Stats Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7218/info Multiple path disclosure vulnerabilities have been reported in various PHP scripts used by PHP-Nuke. The issue occurs when an invalid URI parameter is passed to certain scripts. The affected...

PostNuke 0.72x Members_List Module - Full Path Disclosure

source: https://www.securityfocus.com/bid/7218/info Multiple path disclosure vulnerabilities have been reported in various PHP scripts used by PHP-Nuke. The issue occurs when an invalid URI parameter is passed to certain scripts. The affected scripts do not provide sufficient error handling for...

PostNuke 0.72x Members_List Module - Full Path Disclosure

PostNuke 0.72x MembersList Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7218/info Multiple path disclosure vulnerabilities have been reported in various PHP scripts used by PHP-Nuke. The issue occurs when an invalid URI parameter is passed to certain scripts. The affect...

PostNuke 0.72x Stats Module - Full Path Disclosure

source: https://www.securityfocus.com/bid/7218/info Multiple path disclosure vulnerabilities have been reported in various PHP scripts used by PHP-Nuke. The issue occurs when an invalid URI parameter is passed to certain scripts. The affected scripts do not provide sufficient error handling for...

DCP-Portal Multiple Script Path Disclosure

DCP-Portal discloses its physical path when an empty request to adduser.php is made In addition, several other scripts may disclose the path if an invalid language is supplied, although Nessus has not checked for them. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ahmet Sabri ALPER To:...

Mozilla Bonsai Mutiple Flaws (Auth Bypass, XSS, Cmd Exec, PD)

The remote host has the CGI suite 'Bonsai' installed. This suite is used to browse a CVS repository with a web browser. The remote version of this software is to be vulnerable to various flaws ranging from path disclosure and cross-site scripting to remote command execution. An attacker may explo...

Multiple bonsai bugs

Remote execution of arbitrary commands as www-data, absolute path disclosure, cross site scriptiong attacks, unauthenticated access to parameters page...

[SCSA-011] Path Disclosure Vulnerability in XOOPS

Security Corporation Security Advisory SCSA-011 PROGRAM: XOOPS HOMEPAGE: http://www.xoops.org/ VULNERABLE VERSIONS: v2.0 and prior ? DESCRIPTION XOOPS is "a dynamic OO Object Oriented based open source portal script written in PHP. XOOPS is the ideal tool for developing small to large dynamic...

MyAbraCadaWeb header.php ma_kw Parameter XSS

The remote host seems to be running MyAbraCadaWeb. An attacker may use it to perform a cross-site scripting attack on this host, or to reveal the full path to its physical location by sending a malformed request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc Message-ID: From: "Gregory" Le...

CVE-2002-1454

MyWebServer 1.0.2 allows remote attackers to determine the absolute path of the web document root via a request for a directory that does not exist, which leaks the pathname in an error message...

CVE-2002-1545

CooolSoft Personal FTP Server 2.24 is affected by a vulnerability where a remote attacker can trigger a PWD command to obtain the absolute pathname of the FTP root, exposing the full filesystem path in the response. This is the explicit impact described in CVE-2002-1545. The available documents d...

CVE-2002-1454

MyWebServer 1.0.2 is affected by a path disclosure vulnerability: when requesting a non-existent directory, the error message reveals the absolute path to the web document root, exposing sensitive directory structure. This impacts confidentiality (partial). No remediation details or patch/version...

[SCSA-010] Path Disclosure & Cross Site Scripting Vulnerability in MyABraCaDaWeb

Security Corporation Security Advisory SCSA-010 PROGRAM: MyABraCaDaWeb HOMEPAGE: http://www.webmaster-mag.net/ VULNERABLE VERSIONS: v1.0.2 and prior DESCRIPTION MyABraCaDaWeb is an other Content Management Systems like PHP-Nuke More informations at :...

PHP-Nuke 5.5 and 6.0: Path Disclosure

Product - PHP-Nuke + Version - 5.5, 6.0 other versions not tested jet + Website - http://www.phpnuke.org + Problems - Path Disclosure + Explanation: The fault happens in the file print.php, which this including in the modulos 'News' and 'AvantGo', in the same one is checked that the variable $sid...

MyABraCaDaWeb 1.0 - Full Path Disclosure

MyABraCaDaWeb 1.0 - Full Path Disclosure source: https://www.securityfocus.com/bid/7126/info MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This information could be useful in further attacks against a system hosting the software...