CVE-2009-0828

QuoteBook stores quotes.inc under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information, including user credentials, via a direct request...

CVE-2009-0827

PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request...

CVE-2009-0826

BlogHelper stores commondb.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request...

CVE-2009-0827

PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request...

CVE-2009-0828

QuoteBook stores quotes.inc under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information, including user credentials, via a direct request...

CVE-2009-0826

CVE-2009-0826: BlogHelper stores common_db.inc under the web root with insufficient access control, enabling remote attackers to download the database file containing user credentials via a direct request. The description and linked references confirm exposure of credential data through direct ac...

CVE-2009-0827

CVE-2009-0827 refers to PollHelper where poll.inc is stored under the web root with insufficient access control. This allows remote attackers to download the database file containing user credentials via a direct request. The entry notes a network-accessible issue with partial confidentiality imp...

CVE-2009-0826

BlogHelper stores commondb.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request...

Amoot Web Directory SQL Injection

--------------------------------------------------------- Portal Name: Amoot Web Directory Vendoir : http://amootco.ir Author : PouyaServer , [email protected] Website: http://Pouya-Server.ir Vulnerability : Auth Bypass SQL Injection Vulnerability...

Coppermine Photo Gallery 1.4.20 - 'IMG' Privilege Escalation

!/usr/bin/perl inphex - inphex0 at gmail dot com based on http://milw0rm.com/exploits/8114 - found by StAkeR In case this does not work check out posLine 80 and find another value for it use IO::Socket; use LWP::UserAgent; use LWP::Simple; use HTTP::Cookies; $1 = shift; HOST $h = $1 eq ""?$n = 0:...

JVN#66905322: Apache Tomcat information disclosure vulnerability

Apache Tomcat from the Apache Software Foundation is an implementation of the Java Servlet and JavaServer Page JSP technologies. Apache Tomcat contains a vulnerability which may result in the disclosure of POSTed content from a previous request. Impact A remote attacker could possibly obtain user...

Cisco Security Advisory: Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities Advisory ID: cisco-sa-20090225-anm http://www.cisco.com/warp/public/707/cisco-sa-20090225-anm.shtml Revision 1.0 For Public...

Improper access control

Downloadcenter 2.1 stores common.h under the web root with insufficient access control, which allows remote attackers to obtain user credentials and other sensitive information via a direct request. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-0732

Downloadcenter 2.1 stores common.h under the web root with insufficient access control, which allows remote attackers to obtain user credentials and other sensitive information via a direct request. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Joomla gigCalendar 1.0 SQL Injection gigcal_bands_id

Salvatore "drosophila" Fresta Application: gigCalendar Joomla Component 1.0 http://joomlacode.org/gf/project/gigcalendar/ Version: gigCalendar 1.0 Bug: SQL Injection Exploitation: Remote Dork: inurl:"index.php?option=comgigcal" Date: 21 Feb 2009 Discovered by: Salvatore "drosophila" Fresta Author...

DSA-1722-1 libpam-heimdal - local privilege

Bulletin has no description...

SkaLinks 1.5 - Authentication Bypass

SkaLinks 1.5 - Authentication Bypass Product : SkaLinks Version : 1.5 Dork : Powered by SkaLinks Site: http://www.skalinks.com/ Founded by: Dimi4 Date : 29.01.09 Greetz: antichat SQL-injection, Auth Bypass + URL: http://target.com/skalinks15/admin/ + Admin name : 1' OR 1=1/ Bug Function: function...

CVE-2009-0328

ROBS-PROJECTS Digital Sales IPN aka DS-IPN.NET or DS-IPN Paypal Shop stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request for Database/Sales.mdb...

CVE-2009-0336

Katy Whitton BlogIt! stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request for database/Blog.mdb. NOTE: some of these details are obtained from third party...

Improper access control

ROBS-PROJECTS Digital Sales IPN aka DS-IPN.NET or DS-IPN Paypal Shop stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request for Database/Sales.mdb...