CVE-2013-0651: Undefined Security Weakness

The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request...

CVE-2012-0435: Undefined Security Weakness

SUSE WebYaST before 1.2 0.2.63-0.6.1 allows remote attackers to modify the hosts list, and subsequently conduct man-in-the-middle attacks, via a crafted /host request on TCP port 4984...

CVE-2012-5655: Undefined Security Weakness

The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not properly restrict access to block content, which allows remote attackers to obtain sensitive information via a crafted request...

CVE-2012-5859: Undefined Security Weakness

Samsung Kies Air 2.1.207051 and 2.1.210161 allows remote attackers to cause a denial of service crash via a crafted request to www/apps/KiesAir/jws/ssd.php...

CVE-2012-5901: Undefined Security Weakness

DFLabs PTK 1.0.5 stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read logs, images, or reports via a direct request to the file in the 1 log, 2 images, or 3 report directory...

CVE-2012-5916: Exposure of Sensitive Information to an Unauthorized Actor

Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to 1 docs/new/seditio-createnew-160.sql, 2 docs/upgrade/seditoconverttoutf8.optional.sql, or 3 system/install/install.parser.sql...

CVE-2012-5168: Undefined Security Weakness

ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to 1 user/indexinlineeditorsubmit.php or 2 coursecategory/indexinlineeditorsubmit.php...

CVE-2012-5299: Undefined Security Weakness

Mavili Guestbook, as released in November 2007, allows remote attackers to edit, delete, and approve arbitrary messages via a direct request to 1 edit.asp, 2 delete.asp, or 3 approve.asp...

CVE-2010-5078: Undefined Security Weakness

SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain version information via a direct request to 1 apphire/silverstripeversion or 2 cms/silverstripeversion...

CVE-2012-4001: Improper Input Validation

The modpagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers...

CVE-2011-5144: Undefined Security Weakness

Open Business Management OBM 2.4.0-rc13 and earlier allows remote attackers to obtain configuration information via a direct request to test.php, which calls the phpinfo function...

PT-2012-1399

Name of the Vulnerable Software and Affected Versions SilverStripe versions 2.3.x through 2.3.7 SilverStripe versions 2.4.x through 2.4.0 Description The issue allows remote attackers to obtain sensitive information via a direct request to PHP files in the sapphire, cms, or mysite folders, which...

CVE-2010-5187: Exposure of Sensitive Information to an Unauthorized Actor

SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1, when running on servers with certain configurations, allows remote attackers to obtain sensitive information via a direct request to PHP files in the 1 sapphire, 2 cms, or 3 mysite folders, which reveals the installation path in an error...

CVE-2012-4219: Exposure of Sensitive Information to an Unauthorized Actor

showconfigerrors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file...

CVE-2012-4254: Exposure of Sensitive Information to an Unauthorized Actor

MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information Notices via a direct request to 1 learn/cubemail/restore.php or 2 learn/cubemail/dump.php...

CVE-2012-4255: Exposure of Sensitive Information to an Unauthorized Actor

MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information via a direct request to learn/cubemail/refreshdblist.php, which reveals the installation path in an error message...

PT-2012-5184

Name of the Vulnerable Software and Affected Versions Dir2web version 3.0 Description The issue allows remote attackers to download the database via a direct request for "system/db/website.db". This is due to insufficient access control of sensitive information stored under the web root...

CVE-2011-4309: Undefined Security Weakness

Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL...

CVE-2011-4300: Undefined Security Weakness

The filebrowser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file...

PT-2012-2389

Name of the Vulnerable Software and Affected Versions IBM Lotus Expeditor versions 6.1.x through 6.2.x before 6.2 FP5+Security Pack Description The issue concerns improper access control for requests in the web container, allowing remote attackers to spoof a localhost request origin by crafting...