CVE-2006-6682

CVE-2006-6682 affects chetpasswd 2.3.3. The vulnerability arises from a discrepancy in error messages when authenticating with a valid username versus an invalid one, enabling remote attackers to enumerate valid usernames on the target system. The provided documents confirm the issue and its impa...

TorrentFlux 2.2 (downloaddetails.php) Local File Disclosure Exploit

No description provided by source. Description: TorrentFlux fails to sanitise the variable "alias" in downloaddetails.php. This allows an attacker to include any file they want; the contents is displayed at in the spaces provided and the remaning data is displayed as error messages on the page...

TorrentFlux 2.2 - downloaddetails.php Local File Disclosure

TorrentFlux 2.2 - downloaddetails.php Local File Disclosure Description: TorrentFlux fails to sanitise the variable "alias" in downloaddetails.php. This allows an attacker to include any file they want; the contents is displayed at in the spaces provided and the remaning data is displayed as erro...

CVE-2006-6119

mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation path in various error messages...

CVE-2006-6119

mmgallery 1.55 contains an information disclosure vulnerability where a direct request to thumbs.php allows remote attackers to view error messages that reveal the installation path. This CVE (CVE-2006-6119) is documented with a CVSS v2 base score of 5.0 (Medium) and a network attack vector with ...

CVE-2006-6119

mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation path in various error messages...

Moderate: Red Hat Security Advisory: nss_ldap security update

Updated nssldap packages that fix a security flaw are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. nssldap is a set of C library extensions that allow X.500 and LDAP directory servers to be used ...

DEBIAN-CVE-2006-5718

Cross-site scripting XSS vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter...

XSession race conditions

Race conditions allows different user to see error messages...

USN-364-1: Xsession vulnerability

A race condition existed that would allow other local users to see error messages generated during another user's X session. This could allow potentially sensitive information to be leaked...

CVE-2006-5109

Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for 1 linknavi.php or 2 spotlight.php, which reveals the path in various error messages. NOTE: the information.php, language.php, listdocs.php, popularprod.php, sale.php, checksum.php, and...

Important: Red Hat Security Advisory: apache security update for Stronghold

An updated version of Apache that addresses several security issues is now available for Stronghold 4.0 for Enterprise Linux. This update has been rated as having important security impact by the Red Hat Security Response Team. The Apache HTTP server is a powerful, full-featured, efficient, and...

CVE-2006-5027

Jeroen Vennegoor JevonCMS, possibly pre alpha, allows remote attackers to obtain sensitive information via a direct request for php/main/phplib files 1 dbmsql.inc, 2 dbmssql.inc, 3 dbmysql.inc, 4 dboci8.inc, 5 dbodbc.inc, 6 dboracle.inc, and 7 dbpgsql.inc; and 8 dbsybase.inc, which reveals the pa...

CVE-2006-5027

Jeroen Vennegoor JevonCMS, possibly pre alpha, allows remote attackers to obtain sensitive information via a direct request for php/main/phplib files 1 dbmsql.inc, 2 dbmssql.inc, 3 dbmysql.inc, 4 dboci8.inc, 5 dbodbc.inc, 6 dboracle.inc, and 7 dbpgsql.inc; and 8 dbsybase.inc, which reveals the pa...

CVE-2006-4880

David Bennett PHP-Post PHPp 1.0 and earlier allows remote attackers to obtain sensitive information via a direct request for 1 footer.php, 2 template.php, or 3 lastvisit.php, which reveals the installation path in various error messages...

CVE-2006-4873

CVE-2006-4873 affects Jupiter CMS 1.1.5. A remote attacker can disclose installation paths by requesting specific PHP module files (examples include includes/functions.php, modules/register.php, modules/poll.php, modules/panel.php, modules/pm.php, modules/news.php, modules/templates_change.php, m...

CVE-2006-4743

WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for 1 404.php, 2 akismet.php, 3 archive.php, 4 archives.php, 5 attachment.php, 6 blogger.php, 7 comments.php, 8 comments-popup.php, 9 dotclear.php, 10 footer.php, 11 functions.php, 12...

DEBIAN-CVE-2006-4743

WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for 1 404.php, 2 akismet.php, 3 archive.php, 4 archives.php, 5 attachment.php, 6 blogger.php, 7 comments.php, 8 comments-popup.php, 9 dotclear.php, 10 footer.php, 11 functions.php, 12...

CVE-2006-4735

CVE-2006-4735 pertains to MagpieRSS, where remote attackers can cause information disclosure by directly requesting (1) rss_fetch.inc.php or (2) rss_parse.inc.php, triggering error messages that disclose file paths. This is an information disclosure vulnerability in MagpieRSS that exposes interna...

CVE-2006-4743

WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for 1 404.php, 2 akismet.php, 3 archive.php, 4 archives.php, 5 attachment.php, 6 blogger.php, 7 comments.php, 8 comments-popup.php, 9 dotclear.php, 10 footer.php, 11 functions.php, 12...