CVE-2005-1595

CodeThat ShoppingCart 1.3.1 stores config.ini under the web root, which allows remote attackers to obtain sensitive information via a direct request...

CVE-2005-1552

GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0, when set to create JPEG images, does not properly protect an image even when a password and username is assigned, which may allow remote attackers to gain sensitive information via a direct request to the image...

CVE-2005-1501

MidiCart PHP Shopping Cart allows remote attackers to obtain sensitive information via a direct request to 1 searchlist.php, 2 itemlist.php, or 3 itemshow.php, which reveal the path in a PHP error message...

CVE-2004-1994

FuseTalk 4.0 allows remote attackers to ban other users via a direct request to banning.cfm...

CVE-2004-2060

ASPRunner 2.4 stores the database under the web root in the db directory, which may allow remote attackers to obtain the database via a direct request to the database filename, which is predictable based on table and field names...

CVE-2005-1422

Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to conduct administrator operations and cause a denial of service server or camera shutdown via a direct request to admin.html...

CVE-2005-1028

PHP-Nuke 6.x through 7.6 allows remote attackers to obtain sensitive information via a direct request to 1 index.php with the forumadmin parameter set, 2 the Surveys module, or 3 the YourAccount module, which reveals the path in a PHP error message...

CVE-2005-1137

Simple PHP Blog sphpBlog 0.4.0 allows remote attackers to obtain sensitive information via a direct request to sbfunctions.php, which leaks the full pathname in a PHP error message...

CVE-2002-1353

LocalWEB2000 HTTP server 2.1.0 stores passwords in plain text under the web document root in users.lst, which allows remote attackers to obtain the passwords via a direct request to users.lst...

CVE-2005-1055

TowerBlog 0.6 and earlier stores the login data file under the web root, which allows remote attackers to obtain the MD5 checksums of the username and password via a direct request to the dat/login file...

CVE-2005-1028

PHP-Nuke 6.x through 7.6 allows remote attackers to obtain sensitive information via a direct request to 1 index.php with the forumadmin parameter set, 2 the Surveys module, or 3 the YourAccount module, which reveals the path in a PHP error message...

CVE-2005-0869

phpSysInfo 2.3 allows remote attackers to obtain sensitive information via a direct request to 1 class.OpenBSD.inc.php, 2 class.NetBSD.inc.php, 3 class.FreeBSD.inc.php, 4 class.Darwin.inc.php, 5 XPath.class.php, 6 systemheader.php, or 7 systemfooter.php, which reveal the path in a PHP error messa...

CVE-2004-1571

AJ-Fork 167 is affected by an information-disclosure vulnerability where direct requests to 13 PHP scripts (auto-acronyms.php, auto-archive.php, ount-article-views.php, kses.php, custom-quick-tags.php, disable-all-comments.php, easy-date-format.php, enable-disable-comments.php, filter-by-author.p...

CVE-2004-2155

Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to 1 config/, 2 bookmarks.php, 3 footer.php, 4 main.php, 5 tree.php, or 6 functions.php...

Lucent VitalNet VsSetCookie.exe Direct Request Authentication Bypass

Binary data 1715.prm...

pMachine 1.0/2.x - '/lib/' Multiple Script Direct Request Full Path Disclosures

source: https://www.securityfocus.com/bid/7980/info It has been reported that pMachine is prone to remote a patch disclosure vulnerability when accessing various scripts. When a request is made for a target PHP script, possibly requiring a blank URI parameter, pMachine is said to throw an...