Improper access control

Dmx Forum 2.1a stores includes/bd.inc under the web root with insufficient access control, which allows remote attackers to obtain database username and password information...

CVE-2006-2946

Dmx Forum 2.1a stores includes/bd.inc under the web root with insufficient access control, which allows remote attackers to obtain database username and password information...

CVE-2006-2823

Katrien De Graeve a.shopKart 2.0 aka ashopKart20 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 1 admin/scart.mdb and possibly 2 admin/scart97.mdb...

Improper access control

Katrien De Graeve a.shopKart 2.0 aka ashopKart20 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 1 admin/scart.mdb and possibly 2 admin/scart97.mdb...

CVE-2006-2823

Katrien De Graeve a.shopKart 2.0 aka ashopKart20 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 1 admin/scart.mdb and possibly 2 admin/scart97.mdb...

CVE-2006-2823

CVE-2006-2823 affects a.shopKart 2.0 (aka ashopKart20). The issue is that sensitive data is stored under the web root with insufficient access control, enabling remote retrieval of the database via direct requests to admin/scart.mdb and possibly admin/scart97.mdb. The provided sources confirm the...

CVE-2006-2677

CVE-2006-2677 affects SiteScape Forum 7.2 (and possibly earlier). The issue arises from storing the avf.rc configuration file under the web document root with insufficient access controls, which allows remote attackers to obtain sensitive path information. The publicly available records describe ...

FreeBSD : coppermine -- Multiple File Extensions Vulnerability (0b628470-e9a6-11da-b9f4-00123ffe8333)

Secunia reports : Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious users to compromise a vulnerable system. The vulnerability is caused due to an error in the handling of file uploads where a filename has multiple file extensions. This can be exploited to upload...

sa-caucho.txt

ScanAlert Security Advisory http://www.scanalert.com Caucho Resin Multiple Vulnerabilities - Arbitrary File Access & Information Disclosure Date: 5/16/06 Vendor: Caucho Package: Resin Version: 3.0.17 and 3.0.18 – Vendor Confirmed Credit: ScanAlert’s Security and Enterprise Services Teams. Risk:...

coppermine -- Multiple File Extensions Vulnerability

Secunia reports: Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious users to compromise a vulnerable system. The vulnerability is caused due to an error in the handling of file uploads where a filename has multiple file extensions. This can be exploited to upload...

Code injection

The viewfile servlet in the documentation package resin-doc for Caucho Resin 3.0.17 and 3.0.18 allows remote attackers to obtain the source code for file under the web root via the file parameter...

Design/Logic Flaw

Unspecified vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to read arbitrary files under the web root via unspecified attack vectors related to the OpenTextFile method in Scripting.FileSystemObject...

CVE-2006-2317

CVE-2006-2317 pertains to IdealBB 1.5.4a and earlier. The vulnerability arises from the OpenTextFile usage in Scripting.FileSystemObject, allowing remote attackers to read arbitrary files under the web root via unspecified attack vectors. The NVD notes the impact as partial confidentiality with n...

Land Down Under 802 and below version Path Disclosure Vulnerability

Land Down Under 802 and below version Path Disclosure Vulnerability ------------------------------------------------------------------------------------------------------------------------------- Aria-Security.net Advisory Discovered by:R@1D3N amin emami date:21/04/2006 original...

Improper access control

Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests...

CVE-2006-0232

Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests...

CVE-2006-1718

Magus Perde Clever Copy 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to view the database username and password via a direct request for connect.inc...

Information disclosure

gm-upload.cgi in Greymatter 1.3.1 allows remote authenticated users with upload privileges to execute arbitrary programs by uploading files to locations within the web root. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

[SA19423] Greymatter gm-upload.cgi File Upload Vulnerability

TITLE: Greymatter gm-upload.cgi File Upload Vulnerability SECUNIA ADVISORY ID: SA19423 VERIFY ADVISORY: http://secunia.com/advisories/19423/ CRITICAL: Less critical IMPACT: System access WHERE: From remote SOFTWARE: Greymatter 1.x http://secunia.com/product/1821/ DESCRIPTION: syst3mf4ult has...

Improper access control

PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/USERNAME file...