CVE-2006-1207

PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/USERNAME file...

Improper access control

PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/USERNAME file...

CVE-2006-1207

PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/USERNAME file...

CVE-2006-1209

PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/USERNAME file...

PT-2006-2223 · Php · Php Upload Center

Name of the Vulnerable Software and Affected Versions: PHP Upload Center affected versions not specified Description: The issue allows remote attackers to download password hashes due to insufficient access control. Specifically, password hashes are stored under the web root, making them accessib...

Improper access control

Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password...

CVE-2006-0843

Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password...

[SA18767] FCKeditor File Upload Vulnerability

TITLE: FCKeditor File Upload Vulnerability SECUNIA ADVISORY ID: SA18767 VERIFY ADVISORY: http://secunia.com/advisories/18767/ CRITICAL: Moderately critical IMPACT: System access WHERE: From remote SOFTWARE: FCKeditor 2.x http://secunia.com/product/7973/ DESCRIPTION: rgod has discovered a...

Directory traversal

Directory traversal vulnerability in Files Xaraya module before 0.5.1, when the Archive Directory field on the Modify Config page is blank, allows remote attackers to access files outside of the web root via ".." dot dot sequences...

CVE-2006-0567

Directory traversal vulnerability in Files Xaraya module before 0.5.1, when the Archive Directory field on the Modify Config page is blank, allows remote attackers to access files outside of the web root via ".." dot dot sequences...

CVE-2006-0567

Directory traversal vulnerability in Files Xaraya module before 0.5.1, when the Archive Directory field on the Modify Config page is blank, allows remote attackers to access files outside of the web root via ".." dot dot sequences...

[SA18648] CRE Loaded "files.php" File Upload Security Issue

TITLE: CRE Loaded "files.php" File Upload Security Issue SECUNIA ADVISORY ID: SA18648 VERIFY ADVISORY: http://secunia.com/advisories/18648/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: CRE Loaded 6.x http://secunia.com/product/7173/ DESCRIPTION: kaneda has discover...

CVE-2006-0370

Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes...

CVE-2006-0370

RCBlog 1.03 is affected by CVE-2006-0370 due to insufficient access control that allows remote attackers to view account names and MD5 password hashes by accessing data and config directories under the web root. OpenVAS/Nessus entries corroborate a related directory traversal/vector in RCBlog’s P...

CVE-2006-0370

Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes...

adv20060116.txt

========================================================== Title: Directory traversal in phpXplorer Application: phpXplorer Vendor: http://www.phpxplorer.org Vulnerable Versions: 0.9.33 Bug: directory traversal Date: 16-January-2006 Author: Oriol Torrent Santiago References:...

[Full-disclosure] Secunia Research: ADOdb Insecure Test Scripts Security Issues

====================================================================== Secunia Research 09/01/2006 - ADOdb Insecure Test Scripts Security Issues - ====================================================================== Table of Contents Affected...

CVE-2005-4859

mimicboard2 Mimic2 086 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for mimic2.dat...

CVE-2005-4421

Dev-Editor 3.0 allows remote attackers to access any directory outside the web root whose name is a substring of the web root directory name...

PT-2005-4937 · Adp · Adp Forum

Name of the Vulnerable Software and Affected Versions: ADP Forum versions 2.0 through 2.0.3 Description: The issue allows remote attackers to obtain user credentials due to sensitive information being stored in plaintext files under the web document root with insufficient access control. This can...