1382 matches found
CVE-2002-2024
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for 1 poppassd.php3, 2 login.php3?reason=chpass2, 3 spelling.php3, and 4 ldap.search.php3?ldapserv=nonsense which leaks the information in error messages...
CVE-2002-2024
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for 1 poppassd.php3, 2 login.php3?reason=chpass2, 3 spelling.php3, and 4 ldap.search.php3?ldapserv=nonsense which leaks the information in error messages...
CVE-2002-2009
Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by 1 +/, 2 /, 3 /, and 4 %20/, which leaks the pathname in an error message...
CVE-2002-2007
The CVE-2002-2007 vulnerability affects Apache Tomcat 3.2.3 and 3.2.4, where remote attackers could obtain sensitive information (directory listings and web root path) via erroneous HTTP requests to JSP-related paths (test/jsp, samples/jsp, examples/jsp) or the test/realPath.jsp servlet, leaking ...
CVE-2002-2007
The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages JSP in the 1 test/jsp, 2 samples/jsp and 3 examples/jsp directories, or the 4...
CVE-2002-2024
Horde IMP 2.2.7 is affected. The issue allows remote attackers to obtain the full web root pathname by requesting specific files (poppassd.php3, login.php3?reason=chpass2, spelling.php3, ldap.search.php3?ldap_serv=nonsense), with error messages leaking the information. Impact is information discl...
CVE-2002-2065
WebCalendar 0.9.34 and earlier is affected by an insecure include-file access vulnerability. When the product is built with “browsing in includes directory” enabled, remote attackers can read arbitrary .inc files from the web root. Root cause: insecure include-path handling allows reading local i...
CVE-2005-2229
Blog Torrent 0.92 and earlier stores sensitive files under the web document root in the 1 data or 2 torrents directories with insufficient access control, which allows remote attackers to obtain sensitive information such as account names and password hashes, as demonstrated using data/newusers...
fsboard 2.0 - Directory Traversal
fsboard 2.0 - Directory Traversal source: https://www.securityfocus.com/bid/14111/info FSboard is prone to a directory traversal vulnerability. This could allow a remote attacker to read files outside the Web root. This could only be used to access files to which the Web server has permission. Al...
fsboard 2.0 - Directory Traversal
source: https://www.securityfocus.com/bid/14111/info FSboard is prone to a directory traversal vulnerability. This could allow a remote attacker to read files outside the Web root. This could only be used to access files to which the Web server has permission. All versions of FSboard are vulnerab...
CVE-2002-1801
Vulnerability summary (CVE-2002-1801) ImageFolio versions 2.23 through 2.27 allow remote attackers to obtain sensitive information by querying a nonexistent image category, causing an error message that leaks the web root. This is the explicit impact described across multiple sources (NVD/Red Hat...
CVE-2002-1801
ImageFolio 2.23 through 2.27 allows remote attackers to obtain sensitive information via a nonexistent image category, which leaks the web root in the resulting error message...
CVE-2005-2029
amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file...
CVE-2002-1677
14all.cgi 1.1p15 in mrtgconfig allows remote attackers to determine the physical path to the web root directory via a request with an invalid cfg parameter, which generates an error message that reveals the path...
CVE-2005-1835
NEXTWEB iSite stores databases under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to databases/Users.mdb...
PT-2005-2802 · Nextweb · Nextweb Isite
Name of the Vulnerable Software and Affected Versions: NEXTWEB iSite affected versions not specified Description: The issue allows remote attackers to obtain sensitive information via a direct request to databases/Users.mdb due to insufficient access control. This is because databases are stored...
CVE-2005-1658
CVE-2005-1658 affects MyServer 0.8. A directory traversal flaw in filemanager.cpp allows remote attackers to list the parent directory of the web root by using a URL containing a triple dot ("..."). The NVD/CVE entries document this vulnerability with a CVSSv2 base score of 5.0 (AV:N/AC:L/Au:N/C:...
CVE-2005-1658
Directory traversal vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to list the parent directory of the web root via a URL with a "..." triple dot...
[SA15374] Ultimate Forum Exposure of Encrypted User Credentials
---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: Ultimate Forum Exposure of Encrypted User Credentials...