CVE-2006-6886

phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for 1 files.public-userroot.inc.php or 2 files.private.additions.inc.php in include/inclib/, which reveals the path in various error messages...

CVE-2006-6682

CVE-2006-6682 affects chetpasswd 2.3.3. The vulnerability arises from a discrepancy in error messages when authenticating with a valid username versus an invalid one, enabling remote attackers to enumerate valid usernames on the target system. The provided documents confirm the issue and its impa...

TorrentFlux 2.2 - downloaddetails.php Local File Disclosure

TorrentFlux 2.2 - downloaddetails.php Local File Disclosure Description: TorrentFlux fails to sanitise the variable "alias" in downloaddetails.php. This allows an attacker to include any file they want; the contents is displayed at in the spaces provided and the remaning data is displayed as erro...

TorrentFlux 2.2 (downloaddetails.php) Local File Disclosure Exploit

No description provided by source. Description: TorrentFlux fails to sanitise the variable "alias" in downloaddetails.php. This allows an attacker to include any file they want; the contents is displayed at in the spaces provided and the remaning data is displayed as error messages on the page...

CVE-2006-6119

mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation path in various error messages...

CVE-2006-6119

mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation path in various error messages...

CVE-2006-6119

mmgallery 1.55 contains an information disclosure vulnerability where a direct request to thumbs.php allows remote attackers to view error messages that reveal the installation path. This CVE (CVE-2006-6119) is documented with a CVSS v2 base score of 5.0 (Medium) and a network attack vector with ...

CVE-2006-6052: Undefined Security Weakness

NetEpi Case Manager before 0.98 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...

Moderate: Red Hat Security Advisory: nss_ldap security update

Updated nssldap packages that fix a security flaw are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. nssldap is a set of C library extensions that allow X.500 and LDAP directory servers to be used ...

DEBIAN-CVE-2006-5718

Cross-site scripting XSS vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter...

CVE-2006-5702: Exposure of Sensitive Information to an Unauthorized Actor

Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information MySQL username and password via an empty sortmode parameter in 1 tiki-listpages.php, 2 tiki-lastchanges.php, 3 messu-archive.php, 4 messu-mailbox.php, 5 messu-sent.php, 6 tiki-directoryaddsite.php, 7 tiki-directoryranking.php,...

XSession race conditions

Race conditions allows different user to see error messages...

USN-364-1: Xsession vulnerability

A race condition existed that would allow other local users to see error messages generated during another user's X session. This could allow potentially sensitive information to be leaked...

CVE-2006-5109

Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for 1 linknavi.php or 2 spotlight.php, which reveals the path in various error messages. NOTE: the information.php, language.php, listdocs.php, popularprod.php, sale.php, checksum.php, and...

Important: Red Hat Security Advisory: apache security update for Stronghold

An updated version of Apache that addresses several security issues is now available for Stronghold 4.0 for Enterprise Linux. This update has been rated as having important security impact by the Red Hat Security Response Team. The Apache HTTP server is a powerful, full-featured, efficient, and...

CVE-2006-5027

Jeroen Vennegoor JevonCMS, possibly pre alpha, allows remote attackers to obtain sensitive information via a direct request for php/main/phplib files 1 dbmsql.inc, 2 dbmssql.inc, 3 dbmysql.inc, 4 dboci8.inc, 5 dbodbc.inc, 6 dboracle.inc, and 7 dbpgsql.inc; and 8 dbsybase.inc, which reveals the pa...

CVE-2006-5027

Jeroen Vennegoor JevonCMS, possibly pre alpha, allows remote attackers to obtain sensitive information via a direct request for php/main/phplib files 1 dbmsql.inc, 2 dbmssql.inc, 3 dbmysql.inc, 4 dboci8.inc, 5 dbodbc.inc, 6 dboracle.inc, and 7 dbpgsql.inc; and 8 dbsybase.inc, which reveals the pa...

CVE-2006-4986: Undefined Security Weakness

Grayscale BandSite CMS allows remote attackers to obtain sensitive information via a direct request for 1 certain files in the includes/content directory, 2 includes/showspreview.php, and 3 adminpanel/configform.php; and files in adminpanel/includes/ including 4 mailinglist/disphtmltbl.php, 5...

CVE-2006-4989: Undefined Security Weakness

Patrick Michaelis Wili-CMS allows remote attackers to obtain sensitive information via a direct request for 1 thumbnail.php, 2 functions/admin/all.php, 3 functions/admin/initsession.php, 4 functions/all.php, and 5 certain files in example-view/admintemplates/, which reveals the path in various...

CVE-2006-4880

David Bennett PHP-Post PHPp 1.0 and earlier allows remote attackers to obtain sensitive information via a direct request for 1 footer.php, 2 template.php, or 3 lastvisit.php, which reveals the installation path in various error messages...