PostNuke 0.72x Stats Module - Full Path Disclosure

source: https://www.securityfocus.com/bid/7218/info Multiple path disclosure vulnerabilities have been reported in various PHP scripts used by PHP-Nuke. The issue occurs when an invalid URI parameter is passed to certain scripts. The affected scripts do not provide sufficient error handling for...

DCP-Portal Multiple Script Path Disclosure

DCP-Portal discloses its physical path when an empty request to adduser.php is made In addition, several other scripts may disclose the path if an invalid language is supplied, although Nessus has not checked for them. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ahmet Sabri ALPER To:...

Mozilla Bonsai Mutiple Flaws (Auth Bypass, XSS, Cmd Exec, PD)

The remote host has the CGI suite 'Bonsai' installed. This suite is used to browse a CVS repository with a web browser. The remote version of this software is to be vulnerable to various flaws ranging from path disclosure and cross-site scripting to remote command execution. An attacker may explo...

Multiple bonsai bugs

Remote execution of arbitrary commands as www-data, absolute path disclosure, cross site scriptiong attacks, unauthenticated access to parameters page...

[SCSA-011] Path Disclosure Vulnerability in XOOPS

Security Corporation Security Advisory SCSA-011 PROGRAM: XOOPS HOMEPAGE: http://www.xoops.org/ VULNERABLE VERSIONS: v2.0 and prior ? DESCRIPTION XOOPS is "a dynamic OO Object Oriented based open source portal script written in PHP. XOOPS is the ideal tool for developing small to large dynamic...

MyAbraCadaWeb header.php ma_kw Parameter XSS

The remote host seems to be running MyAbraCadaWeb. An attacker may use it to perform a cross-site scripting attack on this host, or to reveal the full path to its physical location by sending a malformed request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc Message-ID: From: "Gregory" Le...

CVE-2002-1454

MyWebServer 1.0.2 allows remote attackers to determine the absolute path of the web document root via a request for a directory that does not exist, which leaks the pathname in an error message...

CVE-2002-1545

CooolSoft Personal FTP Server 2.24 is affected by a vulnerability where a remote attacker can trigger a PWD command to obtain the absolute pathname of the FTP root, exposing the full filesystem path in the response. This is the explicit impact described in CVE-2002-1545. The available documents d...

CVE-2002-1454

MyWebServer 1.0.2 is affected by a path disclosure vulnerability: when requesting a non-existent directory, the error message reveals the absolute path to the web document root, exposing sensitive directory structure. This impacts confidentiality (partial). No remediation details or patch/version...

[SCSA-010] Path Disclosure & Cross Site Scripting Vulnerability in MyABraCaDaWeb

Security Corporation Security Advisory SCSA-010 PROGRAM: MyABraCaDaWeb HOMEPAGE: http://www.webmaster-mag.net/ VULNERABLE VERSIONS: v1.0.2 and prior DESCRIPTION MyABraCaDaWeb is an other Content Management Systems like PHP-Nuke More informations at :...

PHP-Nuke 5.5 and 6.0: Path Disclosure

Product - PHP-Nuke + Version - 5.5, 6.0 other versions not tested jet + Website - http://www.phpnuke.org + Problems - Path Disclosure + Explanation: The fault happens in the file print.php, which this including in the modulos 'News' and 'AvantGo', in the same one is checked that the variable $sid...

MyABraCaDaWeb 1.0 - Full Path Disclosure

MyABraCaDaWeb 1.0 - Full Path Disclosure source: https://www.securityfocus.com/bid/7126/info MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This information could be useful in further attacks against a system hosting the software...

MyABraCaDaWeb 1.0 - Full Path Disclosure

source: https://www.securityfocus.com/bid/7126/info MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This information could be useful in further attacks against a system hosting the software. http://www.example.com/index.php?IDAdmin=tes...

Thunderstone Software TEXIS Nonexistent File Request Path Disclosure

The Thunderstone Software TEXIS application running on the remote host is affected by an information disclosure vulnerability that allows an unauthenticated, remote attacker to obtain the full path of the web root directory by making a specially crafted request for a nonexistent file. %NASLMINLEV...

ColdFusion on IIS cfm/dbm Diagnostic Error Path Disclosure

It was possible to make the remote web server disclose the physical path to its web root by requesting a MS-DOS device ending in .dbm as in nul.dbm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script was written by Renaud Deraison Modified by Paul Johnston for Westpoint Ltd to displ...

Serv-U < 2.5e Multiple Vulnerabilities (OF, Path Disc)

The remote FTP server discloses the full path to its root through a CWD command for a nonexistent directory. In addition, the server may be prone to a buffer overflow that may allow a remote, authenticated attacker to launch a denial of service attack against the affected software. C Tenable...

PHP-Nuke 5.5/6.0 News Module - Full Path Disclosure

source: https://www.securityfocus.com/bid/7079/info The News module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the information gathered in this manner to mount further attacks...

PHP-Nuke 5.56.0 AvantGo Module - Full Path Disclosure

PHP-Nuke 5.56.0 AvantGo Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7078/info The AvantGo module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the...

PHP-Nuke 5.5/6.0 AvantGo Module - Full Path Disclosure

source: https://www.securityfocus.com/bid/7078/info The AvantGo module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the information gathered in this manner to mount further attacks...

PHP-Nuke 5.56.0 News Module - Full Path Disclosure

PHP-Nuke 5.56.0 News Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7079/info The News module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the information...