CVE-2011-3732: Exposure of Sensitive Information to an Unauthorized Actor

eggBlog 4.1.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/fckeditor/editor/dialog/fckspellerpages/spellerpages/server-scripts/spellchecker.php and certain other files...

CVE-2011-3730: Exposure of Sensitive Information to an Unauthorized Actor

Drupal 7.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/simpletest/tests/upgrade/drupal-6.upload.database.php and certain other files...

PT-2011-4620

Name of the Vulnerable Software and Affected Versions Drupal version 7.0 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by files such as modules/simpletest/tests/upgrade/drupal-6.upload.database.php, which...

CVE-2011-3707: Exposure of Sensitive Information to an Unauthorized Actor

JanRain PHP OpenID library aka php-openid 2.2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Auth/Yadis/Yadis.php and certain other files...

CVE-2011-3711: Exposure of Sensitive Information to an Unauthorized Actor

BIGACE 2.7.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/libs/javascript.inc.php and certain other files...

CVE-2011-3697: Exposure of Sensitive Information to an Unauthorized Actor

Achievo 1.4.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/graph/jpgraph/jpgraphradar.php and certain other files...

CVE-2011-3498: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in Progea Movicon / PowerHMI 11.2.1085 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long request...

CVE-2011-1665: Undefined Security Weakness

PHPBoost 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain backup SQL files via a direct request for predictable filenames in cache/backup/...

CVE-2011-0316: Undefined Security Weakness

The Administrative Console component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15 does not properly restrict access to console servlets, which allows remote attackers to obtain potentially sensitive status information via a direct request...

CVE-2010-4608: Exposure of Sensitive Information to an Unauthorized Actor

Habari 0.6.5 allows remote attackers to obtain sensitive information via a direct request to 1 header.php and 2 commentsitems.php in system/admin/, which reveals the installation path in an error message...

CVE-2010-4112: Exposure of Sensitive Information to an Unauthorized Actor

HP Insight Management Agents before 8.6 allows remote attackers to obtain sensitive information via an unspecified request that triggers disclosure of the full path...

CVE-2010-3615: Undefined Security Weakness

named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful requests for private DNS records via the standard DNS query mechanism...

CVE-2010-4234: Undefined Security Weakness

The web server on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to cause a denial of service device reboot via a large number of requests in a short time interval...

CVE-2010-3896: Improper Authentication

The ESSearchApplication directory tree in IBM OmniFind Enterprise Edition 8.x and 9.x does not require authentication, which allows remote attackers to modify the server configuration via a request to palette.do...

CVE-2010-2941: Use After Free

ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service use-after-free and application crash or possibly execute arbitrary code via a crafted IPP request...

CVE-2010-2731: Improper Authentication

Unspecified vulnerability in Microsoft Internet Information Services IIS 5.1 on Windows XP SP3, when directory-based Basic Authentication is enabled, allows remote attackers to bypass intended access restrictions and execute ASP files via a crafted request, aka "Directory Authentication Bypass...

CVE-2009-4961: Exposure of Sensitive Information to an Unauthorized Actor

Lanai Core 0.6 allows remote attackers to obtain configuration information via a direct request to info.php, which calls the phpinfo function...

CVE-2010-2534: Undefined Security Weakness

The NetworkSyncCommandQueue function in network/networkcommand.cpp in OpenTTD before 1.0.3 does not properly clear a pointer in a linked list, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a crafted request, related to the client command queue...

CVE-2010-1736: Undefined Security Weakness

KrM Haber 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/Krmdb.mdb...

CVE-2010-0738: Exposed Dangerous Method or Function

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET...