CVE-2008-5901: Undefined Security Weakness

iyzi Forum 1.0 beta 3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing a password via a direct request for db/iyziforum.mdb. NOTE: some of these details are obtained from third party informatio...

CVE-2008-5773: Undefined Security Weakness

Nukedit 4.9.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing usernames and passwords via a direct request for database/dbsite.mdb...

CVE-2008-5688: Exposure of Sensitive Information to an Unauthorized Actor

MediaWiki 1.8.1, and other versions before 1.13.3, when the wgShowExceptionDetails variable is enabled, sometimes provides the full installation path in a debugging message, which might allow remote attackers to obtain sensitive information via unspecified requests that trigger an uncaught...

CVE-2008-5602: Undefined Security Weakness

Natterchat 1.12 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for natterchat112.mdb...

CVE-2008-5601: Undefined Security Weakness

User Engine Lite ASP stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for users.mdb...

CVE-2008-5596: Undefined Security Weakness

Ikon AdManager 2.1 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for ikonBAnnerAdManager.mdb...

CVE-2008-5560: Undefined Security Weakness

PostEcards stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for postcards.mdb...

CVE-2008-5308: Undefined Security Weakness

The Simple Forum 3.1d module for LoveCMS 1.6.2 Final does not properly restrict access to administrator functions, which allows remote attackers to change the administrator password via a direct request to modules/simpleforum/admin/index.php...

CVE-2008-5274: Undefined Security Weakness

Todd Woolums ASP News Management 2.2 allows remote attackers to obtain news items via a direct request to 1 rss.asp, 2 viewheadings.asp, or 3 viewnews.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-5130: Undefined Security Weakness

Ocean12 Calendar Manager Gold 2.04 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12cal.mdb...

CVE-2008-5129: Undefined Security Weakness

Ocean12 Poll Manager Pro 1.00 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12poll.mdb...

CVE-2008-4585: Undefined Security Weakness

Belong Software Site Builder 0.1 beta allows remote attackers to bypass intended access restrictions and perform administrative actions via a direct request to admin/home.php...

CVE-2008-4512: Undefined Security Weakness

ASP/MS Access Shoutbox, probably 1.1 beta, stores db/shoutdb.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request...

CVE-2008-4207: Exposure of Sensitive Information to an Unauthorized Actor

Attachmax Dolphin 2.1.0 and earlier does not properly protect info.php in the main folder, which allows remote attackers to obtain sensitive information via a direct request, which invokes the phpinfo function. NOTE: some of these details are obtained from third party information...

CVE-2008-4164: Exposure of Sensitive Information to an Unauthorized Actor

cron.php in MemHT Portal 3.9.0 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...

CVE-2008-3327: Exposure of Sensitive Information to an Unauthorized Actor

Moodle 1.6.5, when displayerrors is enabled, allows remote attackers to obtain sensitive information via a direct request to 1 blog/blogpage.php and 2 course/report/stats/report.php, which reveals the installation path in an error message...

CVE-2008-3303: Undefined Security Weakness

admin/login.php in BilboBlog 0.2.1, when registerglobals is enabled, allows remote attackers to bypass authentication and obtain administrative access via a direct request that sets the login, adminlogin, password, and adminpasswd parameters...

CVE-2008-2864: Exposure of Sensitive Information to an Unauthorized Actor

eLineStudio Site Composer ESC 2.6 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 trigger.asp or 2 common2.asp in cms/include/, which reveals the database path...

CVE-2008-1680: Exposure of Sensitive Information to an Unauthorized Actor

PHP-Nuke Platinum 7.6.b.5 allows remote attackers to obtain configuration information via a direct request to maintenance/index.php, which reveals settings such as magicquotesgpc...

CVE-2008-1506: Exposure of Sensitive Information to an Unauthorized Actor

PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function...