CVE-2007-1192

Thomas R. Pasawicz HyperBook Guestbook 1.30 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an admin password hash via a direct request for data/gbconfiguration.dat...

CVE-2006-7061

Scriptsez.net E-Dating System stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read private messages and leverage them for cross-site scripting XSS attacks...

CVE-2007-0928

Virtual Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an encoded password via a direct request for pwd.txt...

Improper access control

Virtual Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an encoded password via a direct request for pwd.txt...

CVE-2007-0919

Directory traversal vulnerability in Nickolas Grigoriadis Mini Web server MiniWebsvr 0.0.6 allows remote attackers to list the directory immediately above the web root via a ..%00 sequence in the URI...

Improper access control

Siteman 1.1.11 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing password hashes via a direct request for data/members.txt...

Improper access control

Siteman 2.0.x2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing password hashes via a direct request for db/siteman/users.MYD...

CVE-2007-0594

Siteman 2.0.x2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing password hashes via a direct request for db/siteman/users.MYD...

CVE-2007-0593

CVE-2007-0593 affects Siteman 1.1.11, where sensitive data is stored under the web root with insufficient access control. An unauthenticated remote attacker can access data/members.txt to download a database containing password hashes. The description, supported by NVD entries, does not provide t...

Improper access control

Maxtricity Tagger 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for tagger.mdb...

CVE-2007-0543

ZixForum 1.14 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for Zixforum.mdb. NOTE: a followup post suggests that this issue only occurs if the...

Improper access control

ZixForum 1.14 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for Zixforum.mdb. NOTE: a followup post suggests that this issue only occurs if the...

CVE-2007-0546

Toxiclab Shoutbox 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db.mdb...

CVE-2007-0543

ZixForum 1.14 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for Zixforum.mdb. NOTE: a followup post suggests that this issue only occurs if the...

Improper access control

Scriptsez Smart PHP Subscriber aka subscribe stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt...

CVE-2007-0518

Scriptsez Smart PHP Subscriber aka subscribe stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt...

CVE-2007-0518

Scriptsez Smart PHP Subscriber aka subscribe stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt...

CVE-2007-0517

Scriptsez Random PHP Quote 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password information via a direct request for pwd.txt...

CVE-2007-0532

Tuan Do Uploader aka php-uploader 6 beta 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrator password hash via a direct request for userdata/user1.txt...

Directory Traversal in ArsDigita Community System

SUMMARY ======= A directory traversal vulnerability exists in the Ars Digita Community System. A remote attacker could exploit this vulnerability to read arbitrary files with the permissions of the web server. AFFECTED SOFTWARE ================= Ars Digita Community System ACS 3.4.9, 3.4.10, and...