CVE-2007-6497: Undefined Security Weakness

Hosting Controller 6.1 Hot fix 3.3 and earlier 1 allows remote attackers to change arbitrary user profiles via a request to Hosting/Addreseller.asp with modified loginname and email parameters; and 2 allows remote authenticated users to change a credit amount and increase a discount via an...

CVE-2007-6395: Undefined Security Weakness

Flat PHP Board 1.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials via a direct request for the username php file for any user account in users/...

CVE-2007-5942: Undefined Security Weakness

Bandersnatch 0.4 allows remote attackers to obtain sensitive information via a malformed request for index.php with 1 a certain func parameter value; or 2 certain func, jid, page, and limit parameter values; which reveals the path in various error messages...

CVE-2007-5787: Undefined Security Weakness

Micro Login System 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a password via a direct request for userpwd.txt...

CVE-2002-2356: Undefined Security Weakness

HAMweather 2.x allows remote attackers to modify administrative settings and obtain sensitive information via a direct request to hwadmin.cgi...

CVE-2003-1403: Improper Input Validation

foo.php3 in DotBr 0.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function...

CVE-2007-5444: Exposure of Sensitive Information to an Unauthorized Actor

CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files...

CVE-2007-4873: Undefined Security Weakness

SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc...

CVE-2007-5026: Undefined Security Weakness

dBlog CMS, probably 2.0, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing an admin password hash via a direct request for dblog.mdb...

CVE-2007-4259: Undefined Security Weakness

EZPhotoSales 1.9.3 and earlier allows remote attackers to download arbitrary image files via 1 a direct request for a URL under OnlineViewing/galleries/ or 2 navigation of the gallery user interface with JavaScript disabled...

CVE-2007-4093: Undefined Security Weakness

Minb Is Not a Blog minb stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing usernames and encrypted passwords via a direct request for db/users.db...

CVE-2007-3626: Undefined Security Weakness

Unspecified vulnerability in the ADM daemon in Hitachi TPBroker before 20070706 allows remote attackers to cause a denial of service daemon crash via a certain request...

CVE-2005-4856: Undefined Security Weakness

The admin interface in eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051110 does not properly handle authorization errors, which allows remote attackers to obtain sensitive information and see the admin pagelayout and associated templates via a request with 1...

CVE-2007-3556: Undefined Security Weakness

Liesbeth base CMS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an include file containing account credentials via a direct request for config.inc...

CVE-2007-3367: Undefined Security Weakness

Simple CGI Wrapper scgiwrap in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to obtain sensitive information via a direct request, which reveals the path in an error message. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2007-3146: Undefined Security Weakness

Zen Help Desk 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing a password via a direct request for ZenHelpDesk.mdb...

CVE-2007-3083: Undefined Security Weakness

Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...

CVE-2007-2979: Undefined Security Weakness

Techno Dreams Web Directory / Search Engine 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database.mdb...

CVE-2007-2944: Undefined Security Weakness

WabCMS 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/wabcmsn.mdb. NOTE: this issue was originally reported for "webCMS," but this was an error by an unreliable researcher...

CVE-2007-2945: Undefined Security Weakness

RMForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for rmforum.mdb...