WordPress Plugin Firestats - Remote Configuration File Download

WordPress Plugin Firestats - Remote Configuration File Download Exploit Title: Wordpress firestats remote configuration file download Date: 2010-07-09 Author: Jelmer de Hen Software Link: http://firestats.cc/ Version: 1.6.5 Tested on: PHP Do a simple GET request to this file:...

CVE-2010-0984

Acidcat CMS 3.5.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for databases/acidcat3.mdb...

CVE-2010-0984

Acidcat CMS up to version 3.5.3 stores sensitive data under the web root with insufficient access control, allowing remote attackers to download a credentials database (databases/acidcat_3.mdb) via a direct request. This causes Confidentiality impact as described in CVE-2010-0984 (NVD): base CVSS...

Jumi Component for Joomla! <= 2.0.5 Backdoor Detection

The version of Joomla! running on the remote host is affected by a backdoor that is part of a trojan installation of Jumi, a third-party component used for including custom code into Joomla!. An unauthenticated, remote attacker can exploit this backdoor, by using specially crafted input to the...

CVE-2008-7080

Team PHP PHP Classifieds Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request for admin/backup/datadump.sql...

Improper access control

Team PHP PHP Classifieds Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request for admin/backup/datadump.sql...

CVE-2008-7069

All Club CMS ACCMS 0.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database configuration information, including credentials, via a direct request to accms.dat...

CVE-2008-7080

Team PHP PHP Classifieds Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request for admin/backup/datadump.sql...

Design/Logic Flaw

download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php...

CVE-2008-6960

download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php...

DSA-1856-1 mantis - information leak

Bulletin has no description...

MODx config.js.php Information Disclosure

The remote web server is running MODx, an open source content management system. The version of MODx installed on the remote host fails to limit access to the 'core/model/modx/processors/system/config.js.php' script before returning the application's configuration settings, including database...

TikiWiki tiki-graph_formula Remote PHP Code Execution

TikiWiki 'TikiWiki tiki-graphformula Remote PHP Code Execution', 'Description' = %q TikiWiki 'Matteo Cantoni ', 'jduck' , 'License' = MSFLICENSE, 'References' = 'CVE', '2007-5423', 'OSVDB', '40478', 'BID', '26006', , 'Privileged' = false, 'Payload' = 'DisableNops' = true, 6k. Really...

CVE-2008-6869

Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for config/oramon.ini...

CVE-2008-6869

Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for config/oramon.ini...

Design/Logic Flaw

TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credentials by reading this file...

CVE-2009-2358

TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credentials by reading this file...

CVE-2009-2358

TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credentials by reading this file...

DEBIAN-CVE-2008-6756

ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file...

CVE-2008-5956

Wbstreet aka PHPSTREET Webboard 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request to connect.inc...