ipMonitor Encoded Traversal Arbitrary File Access

A directory traversal flaw was discovered by SensePost to affect ipMonitor versions 8.0 and 8.5. Upon sending a specially formed request to the web server, containing a series of '%2f..' sequences, an unauthenticated attacker is able to traverse the web root and obtain files within the remote fil...

Improper access control

MyWebFTP, possibly 5.3.2, stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain an MD5 password hash via a direct request for pass/pass.txt...

CVE-2007-5787

Micro Login System 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a password via a direct request for userpwd.txt...

Improper access control

Blue-Collar Productions i-Gallery 3.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a base64-encoded password via a direct request for igallery.mdb...

CVE-2007-5777

Blue-Collar Productions i-Gallery 3.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a base64-encoded password via a direct request for igallery.mdb...

CVE-2007-5777

CVE-2007-5777 affects Blue-Collar Productions i-Gallery 3.4. The vendor’s application stores sensitive information under the web root with insufficient access control, permitting remote attackers to download a file (igallery.mdb) containing a base64-encoded password via a direct request. The NVD ...

CVE-2007-5787

Micro Login System 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a password via a direct request for userpwd.txt...

CVE-2007-5735

eFileMan 7.1.0.87-88 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain unspecified user information via a direct request for cgi-bin/efileman/efilemanconfig.pm...

Improper access control

eFileMan 7.1.0.87-88 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain unspecified user information via a direct request for cgi-bin/efileman/efilemanconfig.pm...

CVE-2007-5735

eFileMan 7.1.0.87-88 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain unspecified user information via a direct request for cgi-bin/efileman/efilemanconfig.pm...

CVE-2007-5735

CVE-2007-5735 affects eFileMan 7.1.0.87-88. The vulnerability arises from storing sensitive information under the web root with insufficient access control, allowing remote attackers to obtain unspecified user information via a direct request to cgi-bin/efileman/efileman_config.pm. Impact is part...

CVE-2002-2322

Ultimate PHP Board UPB 1.0b stores the users.dat data file under the web root with insufficient access control, which allows remote attackers to obtain usernames and passwords...

CVE-2002-2335

Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows remote attackers to obtain user names and passwords and log in using protection.php...

PHP File Sharing System Index.PHP目录遍历漏洞

PHP File Sharing System是一款基于PHP的WEB应用程序。 PHP File Sharing System不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于'index.php'脚本对用户提交的WEB参数缺少过滤，提交包含"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容。 PHP File Sharing System 1.5.1 目前没有详细解决方案提供： http://sourceforge.net/projects/phpfilesadmin/...

Design/Logic Flaw

Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to download files that were uploaded by users, as demonstrated by obtaining a directory listing via a direct request to /upload and then retrieving...

CVE-2007-5278

Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to download files that were uploaded by users, as demonstrated by obtaining a directory listing via a direct request to /upload and then retrieving...

Improper access control

ASP-CMS 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request for mdb-database/ASP-CMSv100.mdb...

Improper access control

SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc...

CVE-2007-4873

SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc...

CVE-2007-5129

SimpGB 1.46.02 stores sensitive information under the web root with insufficient access control, which allows remote attackers to 1 obtain sensitive configuration information via a direct request for admin/cfginfo.php; and 2 download arbitrary .inc files via a direct request, as demonstrated by...