CVE-2011-3698

AdaptCMS 2.0.2 Beta allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/pollvote.php and certain other files...

CVE-2011-3719

CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/scaffolding/views/view.php and certain other files...

CVE-2011-3727

DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files...

CVE-2011-3720

ConceptCMS 5.3.1 and 5.3.3 (and possibly other versions) are affected by an information-disclosure vulnerability: remote attackers can obtain sensitive info via a direct request to a .php file, with an error message revealing the installation path (e.g., sys_libs/umlib/um_authserver.inc.php). Roo...

CVE-2011-3700

Vulnerability: CVE-2011-3700 in Advanced Electron Forum (AEF) 1.0.8. Issue: Remote attackers can disclose sensitive information by making a direct request to a PHP file (languages/english/deletetopic_lang.php), causing an error message that reveals the installation path. Impact: Information discl...

CVE-2011-3741

CVE-2011-3741 affects Ganglia 3.1.7 and allows remote attackers to disclose sensitive information by requesting certain .php files (e.g., host_view.php), causing error messages that reveal the installation path. The vulnerability is a file-path disclosure via direct access to PHP scripts. The pro...

CVE-2011-3737

CVE-2011-3737 affects eyeOS 2.2.0.0 and enables information disclosure by remote users who can trigger a direct request to certain .php files (e.g., apps/rmail/webmail/program/lib/Net/SMTP.php), causing error messages that reveal the installation path. The vulnerability stems from exposing intern...

CVE-2011-3699

John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/test-active-record.php and certain other files...

CVE-2011-3717

ClipBucket 2.0.9 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/signupcaptcha/signupcaptcha.php and certain other files...

CGI Generic XPath Injection (2nd pass)

By providing specially crafted parameters to CGIs, Nessus was able to get an error from the underlying XPath engine. This error suggests that the CGI is affected by an XPath injection vulnerability. An attacker may exploit this flaw to bypass authentication or read confidential data. %NASLMINLEVE...

Better error message when viewing an embedded calendar as an unprivileged user

On our site's dashboard I have a calendar macro defined as: codecalendar:id=8f564b4b-afed-4ceb-b206-2e426f595648,a80c628d-5155-40bc-8a55-0874fb77bf71code The result is something that looks like this: !User with View Rights.JPEG! After using the new features from TEAMCAL-102 to restrict view acces...

Better error message when viewing an embedded calendar as an unprivileged user

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-51101. panel On our site's dashboard I have a calendar macro defined as:...

Better error message when viewing an embedded calendar as an unprivileged user

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-51101. panel On our site's dashboard I have a calendar macro defined as:...

CVE-2011-3264

Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message...

Design/Logic Flaw

Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message...

CVE-2011-3264

Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message...

MySpace goes down because of Internal Errors, Not Hacked !

MySpace goes down because of Internal Errors, Not Hacked ! MySpace website was presented with a curious message that left many users believing that the service had been hacked. That apparently was not the case. Visitors to the social network were greeted by a largely blank page topped with the...

libpng: regression of CVE-2004-0421 in 1.2.23+

The pngformatbuffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service application crash via a crafted PNG image that triggers an out-of-bounds read during the copying of...

Analysis of the postgresql database attack techniques II-vulnerability warning-the black bar safety net

You can see we broke up in a field for the name, then we continue incrementing the offset value, to obtain the other field, as shown in Figure 9 and 1=2 union select 1,columnname,'3','4' from informationschema. the columns where tablename='admins' offset 2 limit 1-- ! Figure 9 Field passowrd is...

Trojan Last Door v6 (Latest version) Denial of service

Exploit for windows platform in category dos / poc / LostDoor v6 Remote Denial Of Service Author: Kevin R.V Date: 2011 License: Totally free 8- Some information: The protocol used by LastDoor v6 is a simply clear text protocol with a delimitter, thats a normal packet to connect v1ct1m\AS/My...