CVE-2008-5130: Undefined Security Weakness

Ocean12 Calendar Manager Gold 2.04 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12cal.mdb...

CVE-2008-4585: Undefined Security Weakness

Belong Software Site Builder 0.1 beta allows remote attackers to bypass intended access restrictions and perform administrative actions via a direct request to admin/home.php...

CVE-2008-4512: Undefined Security Weakness

ASP/MS Access Shoutbox, probably 1.1 beta, stores db/shoutdb.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request...

CVE-2008-4207: Exposure of Sensitive Information to an Unauthorized Actor

Attachmax Dolphin 2.1.0 and earlier does not properly protect info.php in the main folder, which allows remote attackers to obtain sensitive information via a direct request, which invokes the phpinfo function. NOTE: some of these details are obtained from third party information...

CVE-2008-4164: Exposure of Sensitive Information to an Unauthorized Actor

cron.php in MemHT Portal 3.9.0 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...

CVE-2008-3327: Exposure of Sensitive Information to an Unauthorized Actor

Moodle 1.6.5, when displayerrors is enabled, allows remote attackers to obtain sensitive information via a direct request to 1 blog/blogpage.php and 2 course/report/stats/report.php, which reveals the installation path in an error message...

CVE-2008-3303: Undefined Security Weakness

admin/login.php in BilboBlog 0.2.1, when registerglobals is enabled, allows remote attackers to bypass authentication and obtain administrative access via a direct request that sets the login, adminlogin, password, and adminpasswd parameters...

CVE-2008-2864: Exposure of Sensitive Information to an Unauthorized Actor

eLineStudio Site Composer ESC 2.6 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 trigger.asp or 2 common2.asp in cms/include/, which reveals the database path...

CVE-2008-1680: Exposure of Sensitive Information to an Unauthorized Actor

PHP-Nuke Platinum 7.6.b.5 allows remote attackers to obtain configuration information via a direct request to maintenance/index.php, which reveals settings such as magicquotesgpc...

CVE-2008-1506: Exposure of Sensitive Information to an Unauthorized Actor

PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function...

CVE-2008-1327: Improper Authentication

Gallarific does not require authentication for 1 users.php and 2 index.php, which allows remote attackers to add and edit tasks via a direct request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1181: Exposure of Sensitive Information to an Unauthorized Actor

Juniper Networks Secure Access 2000 5.5 R1 build 11711 allows remote attackers to obtain sensitive information via a direct request for remediate.cgi without certain parameters, which reveals the path in an "Execute failed" error message...

CVE-2008-0982: Improper Input Validation

Spyce - Python Server Pages PSP 2.1.3 allows remote attackers to obtain sensitive information via a direct request for spyce/examples/automaton.spy, which reveals the path in an error message...

CVE-2003-1541: Undefined Security Weakness

PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin script password, and other passwords, via a direct request to files/passwd.txt...

Cross site request forgery (csrf)

HTTP File Server HFS before 2.2c tags HTTP request log entries with the username sent during HTTP Basic Authentication, regardless of whether authentication succeeded, which might make it more difficult for an administrator to determine who made a remote request...

CVE-2008-0149: Undefined Security Weakness

TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function...

CVE-2008-0135: Undefined Security Weakness

Snitz Forums 2000 3.4.06 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for forum/snitzforums2000.mdb...

CVE-2008-0136: Exposure of Sensitive Information to an Unauthorized Actor

Snitz Forums 2000 3.4.05 allows remote attackers to obtain sensitive information via a direct request to forum/whereami.asp, which reveals the database path...

CVE-2007-6603: Undefined Security Weakness

Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attackers to obtain the administrator username and password via a direct request to control/backup/backup.php, which generates a backup/dump/backup.sql file that can be downloaded via ...

CVE-2007-6607: Exposure of Sensitive Information to an Unauthorized Actor

OpenBiblio 0.5.2-pre4 and earlier allows remote attackers to obtain sensitive information via a direct request for 1 shared/footer.php, 2 circ/mbrfields.php, or 3 admin/custommarcformfields.php, which reveals the path in various error messages...