Debian DSA-1056-1 : webcalendar - verbose error message

David Maciejak noticed that webcalendar, a PHP-based multi-user calendar, returns different error messages on login attempts for an invalid password and a non-existing user, allowing remote attackers to gain information about valid usernames. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

httpd: Expect header XSS

httpprotocol.c in 1 IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and 2 Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site...

CVE-2006-4960

Cross-site scripting XSS vulnerability in index.php Php Blue Dragon 2.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the m parameter, which is reflected in an error message resulting from a failed SQL query...

CVE-2006-4938

help.php in Moodle before 1.6.2 does not check the existence of certain help files before including them, which might allow remote authenticated users to obtain the path in an error message...

CVE-2006-4938

Moodle before 1.6.2 contains a vulnerability in help.php where it does not verify the existence of certain help files before including them, which may allow a remote authenticated user to cause an error message that reveals the file path. The CVE is documented in multiple sources (NVD entry for C...

CVE-2006-4787

AlphaMail before 1.0.16 allows local users to obtain sensitive information via the logging functionality, which displays unencrypted passwords in an error message. NOTE: some details are obtained from third party information...

CVE-2006-4740

Jetbox CMS allows remote attackers to obtain sensitive information via a direct request for certain files, which reveal the path in an error message...

CVE-2006-4740

Jetbox CMS allows remote attackers to obtain sensitive information via a direct request for certain files, which reveal the path in an error message...

CVE-2006-0032

Cross-site scripting XSS vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose...

httpd: Expect header XSS

httpprotocol.c in 1 IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and 2 Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site...

CVE-2006-3841

Cross-site scripting XSS vulnerability in WebScarab before 20060718-1904, when used with Microsoft Internet Explorer 6 SP2 or Konqueror 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the URL, which is not sanitized before being returned in an error message when WebScara...

CVE-2006-3469

Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service crash via a format string instead of a date as the first parameter to the dateformat function, which is later used in a formatted pri...

Cross-site scripting-vulnerability warning-the black bar safety net

What is cross-site scriptingCSS/XSS? We said the cross-site scripting refers to a remote WEB page's html code is inserted with the malicious purpose of the data, the user that the The page is trustworthy, but when the browser downloads the page, the embedded script will be interpreted, Sometimes...

CVE-2006-3389

index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any...

CVE-2006-3360

Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. dot dot sequence and a trailing null %00 byte in the lng parameter, which will display a different error message if the file exists...

CVE-2006-3360

Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. dot dot sequence and a trailing null %00 byte in the lng parameter, which will display a different error message if the file exists...

[Full-disclosure] phpSysInfo arbitrary file identification

phpSysInfo is a popular webscript for displaying stats about a webserver available from http://phpsysinfo.sourceforge.net/ with 365012 downloads to date. A vulnerability which allows an attacker to identify if a file exists on the remote system has been identified. By supplying a directory...

CVE-2006-3333

Cross-site scripting XSS vulnerability in index.php in Zorum Forum 3.5 allows remote attackers to inject web script or HTML via the multiple unspecified parameters, including the 1 frommethod, 2 list, and 3 method, which are reflected in an error message. NOTE: some of these vectors might be...

CVE-2006-3333

Cross-site scripting XSS vulnerability in index.php in Zorum Forum 3.5 allows remote attackers to inject web script or HTML via the multiple unspecified parameters, including the 1 frommethod, 2 list, and 3 method, which are reflected in an error message. NOTE: some of these vectors might be...

error_log() Safe Mode Bypass PHP 5.1.4 and 4.4.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 errorlog Safe Mode Bypass PHP 5.1.4 and 4.4.2 Author: Maksymilian Arciemowicz cXIb8O3 Date: - -Written: 10.6.2006 - -Public: 26.06.2006 from SECURITYREASON.COM CVE-2006-3011 - --- 0.Description --- PHP is an HTML-embedded scripting language. Much of i...