Code injection

Flyspray 0.9.9.4 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames...

flyspray -- multiple vulnerabilities

The Flyspray Project reports: Flyspray is affected by a Cross Site scripting Vulnerability due to an error escaping PHP's $SERVER'QUERYSTRING' superglobal, that can be maliciously used to inject arbitrary code into the savesearch javascript function. There is an XSS problem in the history tab, th...

CVE-2007-5958

X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in the -sp option to the X program, which produces different error messages depending on whether the filename exists...

CVE-2007-5958

X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in the -sp option to the X program, which produces different error messages depending on whether the filename exists...

Xorg / XFree86 file existence disclosure vulnerability

X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in the -sp option to the X program, which produces different error messages depending on whether the filename exists...

Debian: Security Advisory (DSA-1056-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2008-0195

WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages...

CVE-2008-0195

WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages...

DEBIAN-CVE-2008-0195

WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages...

CVE-2008-0195

WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages...

Privileg escalation in Omegasoft Insel 7

Hi list, Omegasoft's Insel 7 stores Cookies on your computer for identifying the logged-in user. As these Cookies do not contain any password hash but only the username and some meaningless stuff you can easily get into the system with another login. this gets even more easy, as there is a...

CVE-2007-6660

2z project 0.9.6.1 allows remote attackers to obtain sensitive information via 1 a request to index.php with an invalid template or 2 a request to the default URI with certain year and month parameters, which reveals the path in various error messages...

Design/Logic Flaw

2z project 0.9.6.1 allows remote attackers to obtain sensitive information via 1 a request to index.php with an invalid template or 2 a request to the default URI with certain year and month parameters, which reveals the path in various error messages...

CVE-2007-6660

The CVE-2007-6660 entry involves the 2z project version 0.9.6.1 where information disclosure can occur via (1) a request to index.php with an invalid template or (2) a request to the default URI with certain year/month parameters, causing error messages that reveal the path. The NVD description d...

CVE-2007-6660

2z project 0.9.6.1 allows remote attackers to obtain sensitive information via 1 a request to index.php with an invalid template or 2 a request to the default URI with certain year and month parameters, which reveals the path in various error messages...

CVE-2007-6617

Cross-site scripting XSS vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to secure/CreateIssue...

CVE-2007-6617

CVE-2007-6617 is a documented XSS vulnerability in the Atlassian Jira product, specifically in 500page.jsp for Jira Enterprise Edition before 3.12.1. The issue arises from improper handling of error messages, allowing a remote attacker to inject arbitrary script/HTML via input originally sent in ...

Atlassian JIRA < 3.12.1 Multiple Vulnerabilities

Binary data 4329.prm...

Design/Logic Flaw

OpenBiblio 0.5.2-pre4 and earlier allows remote attackers to obtain sensitive information via a direct request for 1 shared/footer.php, 2 circ/mbrfields.php, or 3 admin/custommarcformfields.php, which reveals the path in various error messages...

CVE-2007-6408

IBM Tivoli Provisioning Manager Express provides unspecified information in error messages when 1 attempted duplication of a username occurs when creating an account or 2 when trying to login using a valid username, which makes it easier for remote attackers to enumerate usernames...