CVE-2009-0815

The jumpUrl mechanism in class.tslibfe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret juHash in an error message, which allows remote attackers to read arbitrary files by including the hash in a request...

CVE-2009-0815

TYPO3 jumpUrl File Disclosure (CVE-2009-0815) affects TYPO3 3.3.x–3.8.x and some 4.x lines (up to 4.3alpha1). The flaw leaks a hash secret (juHash) in error messages, enabling remote attackers to read arbitrary server files by including the hash in a request. Connected advisories (GHSA/CIRCL/NVD/...

CVE-2009-0747

The ext4isize function in fs/ext4/ext4.h in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 uses the isizehigh structure member during operations on arbitrary types of files, which allows local users to cause a denial of service CPU consumption and error-message flood by...

CVE-2009-0747

The CVE-2009-0747 issue affects the Linux kernel’s ext4_isize helper in fs/ext4/ext4.h, exposing a denial-of-service risk when a local user mounts a crafted ext4 filesystem. The vulnerability arises from using the i_size_high structure member during operations on arbitrary file types, potentially...

CVE-2008-6279

RakhiSoftware Price Comparison Script aka Shopping Cart allows remote attackers to obtain sensitive information via an invalid PHPSESSID cookie, which reveals the installation path in an error message...

CVE-2008-6279

RakhiSoftware Price Comparison Script aka Shopping Cart allows remote attackers to obtain sensitive information via an invalid PHPSESSID cookie, which reveals the installation path in an error message...

CVE-2008-6279

Vulnerability: RakhiSoftware Price Comparison Script (Shopping Cart) exposes installation path in error messages via an invalid PHPSESSID cookie, enabling remote disclosure of sensitive information. Affected: RakhiSoftware Price Comparison Script; root cause: PHPSESSID handling leads to error det...

Design/Logic Flaw

images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message...

SuSE 10 Security Update : net-snmp (ZYPP Patch Number 5807)

Remote attackers could crash net-snmp via GETBULK-Request. CVE-2008-4309 In addition the following non-security issues have been fixed : - typo in error message. bnc439857 - fix duplicate registration warnings on startup. bnc326957 - container insert errors reproducable with shared ip setups...

phpAddEdit 1.3 Local File Inclusion

phpaddedit-1.3 LFI Author: nuclear script:http://sourceforge.net/projects/phpaddedit/ vuln:http://target.com/addedit-render.php?editform=../../../../../../../etc/passwd%00 vulnerable code: if !$formname && $GET"editform" $formname = $GET"editform"; ... if $errormessage || $error ||...

Manual crack fast flash reduction-vulnerability warning-the black bar safety net

Information source: evil octal information security team www.eviloctal.com） Article author: monsterok（monster） Go to the cafe Internet, I downloaded a half-day things, can let I accidentally put the computer the power to kick, because the cafe machine is installed restore, reboot after everything...

CVE-2008-4730

Cross-site scripting XSS vulnerability in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openidtrustroot parameter and an inconsistent openidreturnto parameter, which is not properly handled in an error message...

CVE-2008-4638

qioadmin in the Quick I/O for Database feature in Symantec Veritas File System VxFS on HP-UX, and before 5.0 MP3 on Solaris, Linux, and AIX, allows local users to read arbitrary files by causing qioadmin to write a file's content to standard error in an error message...

CVE-2008-4638

qioadmin in the Quick I/O for Database feature in Symantec Veritas File System VxFS on HP-UX, and before 5.0 MP3 on Solaris, Linux, and AIX, allows local users to read arbitrary files by causing qioadmin to write a file's content to standard error in an error message...

CVE-2008-3060

V-webmail 1.5.0 allows remote attackers to obtain sensitive information via 1 malformed input in the login page includes/local.hooks.php and 2 an invalid session ID, which reveals the installation path in an error message...

Information disclosure

cron.php in MemHT Portal 3.9.0 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...

Design/Logic Flaw

createaccount.php in osCommerce 2.2 RC 2a allows remote attackers to obtain sensitive information via an invalid dob parameter, which reveals the installation path in an error message...

Information disclosure

themes/sample/theme.php in Coppermine Photo Gallery CPG 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...

Design/Logic Flaw

searchresult.cfm in Jobbex JobSite allows remote attackers to obtain sensitive information via unspecified vectors that reveal the installation path in an error message...

Design/Logic Flaw

BilboBlog 0.2.1 allows remote attackers to obtain sensitive information via 1 an enablecache=false query string to footer.php or 2 a direct request to pagination.php, which reveals the installation path in an error message...