328 matches found
UBUNTU-CVE-2015-3187
The svnrepostracenodelocations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path...
MGASA-2014-0483 Updated moodle package fixes security vulnerabilities
In Moodle before 2.6.5, without forcing encoding, it was possible that UTF7 characters could be used to force cross-site scripts to AJAX scripts although this is unlikely on modern browsers and on most Moodle pages MSA-14-0035. In Moodle before 2.6.5, an XSS issue through $searchcourse in...
Design/Logic Flaw
The ShareYourCart plugin 1.7.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors related to the SDK...
ECShop v2. 7. 2 wap page storm path 0day-vulnerability warning-the black bar safety net
Google: inurl:mobile/goods. php? act=viewimg&id=1 2 3 Search to After in page plus&id=5 That is, http://www. badguest. cn/mobile/goods. php? act=viewimg&id=1 2 3&id=5 For example, for many forums, submitted a non-existent file request, or submit a There is no output file of the request, the serve...
Design/Logic Flaw
PHPfileNavigator 2.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xestion/varios/logs.inc.php and certain other files...
UBUNTU-CVE-2011-3699
John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/test-active-record.php and certain other files...
Awstats statistics permissions assigned improperly leads to explosive path-vulnerability warning-the black bar safety net
Vulnerability details Brief description: Awstats statistics permissions assigned improperly leads to explosive path Detailed description: Awstats is a Perl-based WEB Log analysis and Statistics tool. Due to the simplicity of powerful features and by many administrators of all ages, its default...
[20090606] - Core - Missing JEXEC Check
Some files were missing the check for JEXEC. These scripts will then expose internal path information of the host...
Design/Logic Flaw
RakhiSoftware Price Comparison Script aka Shopping Cart allows remote attackers to obtain sensitive information via an invalid PHPSESSID cookie, which reveals the installation path in an error message...
Java Web Start exposes username and the pathname of the JWS cache
Unspecified vulnerability in Java Web Start JWS and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted JWS applications to obtain the pathname of the JWS cache and the application username via unknown vectors, aka CR 6727071...
CVE-2008-3327
Moodle 1.6.5, when displayerrors is enabled, allows remote attackers to obtain sensitive information via a direct request to 1 blog/blogpage.php and 2 course/report/stats/report.php, which reveals the installation path in an error message...
[HSC] Snitz Forums Multiple Vulnerabilities
HSC Snitz Forums Multiple Vulnerabilities Snitz Forums Default Database installation allows remote users to download the database which contains critical information. As a result, an attacker exploiting this vulnerability will be able to obtain detailed information. An attacker may leverage xss...
security flaw
htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file using the config parameter, which generates an error message that includes the full path...
Wordpress物理路径暴露漏洞
wordpress的模板文件，缺少访问验证，直接访问模板里的文件，就会泄露物理路径。这个不是PHP漏洞，是WordPress的漏洞。 比如访问:http://hostname/wordpress/wp-content/themes/default 就会显示: Fatal error: Unknown function: getheader in /home/publichtml/yz/wp-content/themes/default/index.php on line 1 wordpress 2.1.2 以及之前的版本 在模板里的文件头部加上以下代码，可以防止泄露路径。 ?php...
CVE-2006-7171
productreview.php in Koan Software Mega Mall allows remote attackers to obtain the installation path via a request with an empty value of the x parameter...
CVE-2006-6943
PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to a scripts/checklang.php and b themes/darkblueorange/layout.inc.php; and via the 1 lang, 2 target, 3 db, 4 goto, 5 table, and 6 tblgroup array arguments to c index.php, and the 7 back argument t...
DEBIAN-CVE-2007-0262
WordPress 2.0.6, and 2.1Alpha 3 SVN:4662, does not properly verify that the m parameter value has the string data type, which allows remote attackers to obtain sensitive information via an invalid m parameter, as demonstrated by obtaining the path, and obtaining certain SQL information such as th...
CVE-2006-6273
spindex.php in Simple PHP Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid dir parameter, which reveals the path in an error message...
USN-360-1: awstats vulnerabilities
awstats did not fully sanitize input, which was passed directly to the user's browser, allowing for an XSS attack. If a user was tricked into following a specially crafted awstats URL, the user's authentication information could be exposed for the domain where awstats was hosted. CVE-2006-3681...
