4685 matches found
CVE-2010-4611
Html-edit CMS 3.1.8 allows remote attackers to obtain sensitive information via a direct request to 1 pages.php and 2 menu.php in includes/corefiles and 3 extensions/login/frontend/pages/antihacker.php, which reveals the installation path in an error message...
CVE-2010-4511
Unspecified vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 has unknown impact and attack vectors related to the "dynamic publishing error message."...
PT-2010-5514
Name of the Vulnerable Software and Affected Versions Movable Type versions 4.x through 4.34 Movable Type versions 5.x through 5.03 Description The issue is related to the dynamic publishing error message and has an unknown impact and attack vectors. Recommendations For Movable Type versions 4.x...
CVE-2010-4511: Undefined Security Weakness
Unspecified vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 has unknown impact and attack vectors related to the "dynamic publishing error message."...
CVE-2010-4401
languages.inc.php in DynPG CMS 4.2.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...
Information disclosure
languages.inc.php in DynPG CMS 4.2.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...
CVE-2010-4403
The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to 1 dashwidget.php and 2 register-plus.php, which reveals the installation path in an error message...
Installation Path Disclosure Weakness in CLANSPHERE
High-Tech Bridge SA Security Research Lab has discovered a weakness in CLANSPHERE which could be exploited to gain access to potentially sensitive information. 1 Installation path disclosure weakness in CLANSPHERE The weakness exists due to application reveals the full path to installation...
XSS in Horde Application Framework <=3.3.8, icon_browser.php
Hi, Horde Application Framework v3.3.8 and lower are subject to a cross site scripting XSS vulnerability. The iconbrowser.php script fails to properly sanitize user supplied input to the 'subdir' URL parameter before printing it out as part of a HTML formatted error message. The following URL can...
FreeBSD : bugzilla -- information disclosure, denial of service (8cbf4d65-af9a-11df-89b8-00151735203a)
A Bugzilla Security Advisory reports : - Remote Information Disclosure : An unprivileged user is normally not allowed to view other users' group membership. But boolean charts let the user use group-based pronouns, indirectly disclosing group membership. This security fix restricts the use of...
CVE-2010-2758
Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 generates different error messages depending on whether a product exists, which makes it easier for remote attackers to guess product names via unspecified use of the 1 Reports or 2 Duplicates page...
CVE-2010-2758
Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 generates different error messages depending on whether a product exists, which makes it easier for remote attackers to guess product names via unspecified use of the 1 Reports or 2 Duplicates page...
CVE-2010-2758
CVE-2010-2758 concerns Bugzilla where error messages differ depending on whether a product exists, enabling remote users to enumerate product names. Affected versions include Bugzilla 2.17.1–3.2.7, 3.3.1–3.4.7, 3.5.1–3.6.1, and 3.7–3.7.2. The connected documents reference Fedora/OpenVAS advisorie...
rekonq 'Error Page' Cross-Site Scripting Vulnerabilities
This host is installed with rekonq and is prone to cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbrekonqmultxssvuln.nasl 4919 2017-01-02 15:22:45Z cfi $ rekonq 'Error Page' Cross-Site Scripting Vulnerabilities. Authors: Madhuri D Copyright: Copyright c 2010 Greenbone...
bugzilla -- information disclosure, denial of service
A Bugzilla Security Advisory reports: Remote Information Disclosure: An unprivileged user is normally not allowed to view other users' group membership. But boolean charts let the user use group-based pronouns, indirectly disclosing group membership. This security fix restricts the use of pronoun...
httpd: Expect header XSS
httpprotocol.c in 1 IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and 2 Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site...
CVE-2010-2854
Multiple cross-site scripting XSS vulnerabilities in modfile.php in Event Horizon EVH 1.1.10, when magicquotesgpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the 1 YourEmail and 2 VerificationNumber parameters, which are not properly handled in a forced SQL erro...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in modfile.php in Event Horizon EVH 1.1.10, when magicquotesgpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the 1 YourEmail and 2 VerificationNumber parameters, which are not properly handled in a forced SQL erro...
Design/Logic Flaw
news.php in SimpNews 2.47.3 and earlier allows remote attackers to obtain sensitive information via an invalid lang parameter, which reveals the installation path in an error message...