Design/Logic Flaw

Photostand 1.2.0 allows remote attackers to obtain sensitive information via a ' quote character in 1 a PHPSESSID cookie or 2 the id parameter in an article action in index.php, which reveal the path in various error messages...

CVE-2007-1102

Photostand 1.2.0 allows remote attackers to obtain sensitive information via a ' quote character in 1 a PHPSESSID cookie or 2 the id parameter in an article action in index.php, which reveal the path in various error messages...

CVE-2007-1102

Photostand 1.2.0 allows remote attackers to obtain sensitive information via a ' quote character in 1 a PHPSESSID cookie or 2 the id parameter in an article action in index.php, which reveal the path in various error messages...

CVE-2006-7000

Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to 1 email/mail.php, 2 includes/init.php, 3 certain files in includes/cron/, and 4 jpgraph.php, 5 jpgraphbar.php, 6 jpgraphpie.php, and 7 jpgraphpie3d.php in includes/graph/, which leaks the path in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Symantec Web Security SWS before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 error messages and 2 blocked page messages produced by SWS...

CVE-2007-0563

Multiple cross-site scripting XSS vulnerabilities in Symantec Web Security SWS before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 error messages and 2 blocked page messages produced by SWS...

CVE-2007-0509

MaklerPlus

Microsoft .NET Custom Errors Not Set

The remote ASP.NET web server is configured to show verbose error messages, which might lead to the disclosure of potentially sensitive information about the remote installation such as the path under which the remote web server resides or about the remote ASP.NET applications. C Tenable Network...

CVE-2007-0375

Joomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for 1 plugins/user/example.php; 2 gmail.php, 3 example.php, or 4 ldap.php in plugins/authentication/; 5 modules/modmainmenu/menu.php; or other unspecified PHP scripts, which reveals the path in various...

Information disclosure

Joomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for 1 plugins/user/example.php; 2 gmail.php, 3 example.php, or 4 ldap.php in plugins/authentication/; 5 modules/modmainmenu/menu.php; or other unspecified PHP scripts, which reveals the path in various...

CVE-2007-0375

Joomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for 1 plugins/user/example.php; 2 gmail.php, 3 example.php, or 4 ldap.php in plugins/authentication/; 5 modules/modmainmenu/menu.php; or other unspecified PHP scripts, which reveals the path in various...

CVE-2007-0375

Joomla! 1.5.0 Beta is affected by CVE-2007-0375. Remote attackers can obtain sensitive information by directly requesting specific PHP scripts (e.g., plugins/user/example.php, gmail.php, example.php, ldap.php in plugins/authentication; modules/mod_mainmenu/menu.php). The root cause is a jimport f...

Design/Logic Flaw

BMC Remedy Action Request System 5.01.02 Patch 1267 generates different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to determine valid account names...

CVE-2007-0310

The CVE-2007-0310 entry concerns BMC Remedy Action Request System 5.01.02 Patch 1267. The vulnerability arises because login error messages differ between valid‑username and invalid‑username attempts, allowing remote attackers to enumerate valid account names. Impact stated: attacker can determin...

Remedy Action Request System 5.01.02 - User Enumeration

======================================================= Remedy Action Request System User Enumeration ======================================================= Davide Del Vecchio Adv11 Discovered in: 08/01/2007 Version affected: Remedy Action Request System 5.01.02 Patch 1267. The same vulnerable...

CVE-2007-0195

CVE-2007-0195 affects F5 FirePass 5.4–5.5.1 and 6.0. The issue is that authentication error messages differ between valid and invalid usernames, enabling remote attackers to confirm the existence of LDAP accounts. The connected documents confirm the affected product/versions and the exploitation ...

CVE-2007-0109

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2007-0109

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2007-0109

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2006-6886

phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for 1 files.public-userroot.inc.php or 2 files.private.additions.inc.php in include/inclib/, which reveals the path in various error messages...