3208 matches found
CVE-2006-4873
CVE-2006-4873 affects Jupiter CMS 1.1.5. A remote attacker can disclose installation paths by requesting specific PHP module files (examples include includes/functions.php, modules/register.php, modules/poll.php, modules/panel.php, modules/pm.php, modules/news.php, modules/templates_change.php, m...
CVE-2006-4743
WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for 1 404.php, 2 akismet.php, 3 archive.php, 4 archives.php, 5 attachment.php, 6 blogger.php, 7 comments.php, 8 comments-popup.php, 9 dotclear.php, 10 footer.php, 11 functions.php, 12...
DEBIAN-CVE-2006-4743
WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for 1 404.php, 2 akismet.php, 3 archive.php, 4 archives.php, 5 attachment.php, 6 blogger.php, 7 comments.php, 8 comments-popup.php, 9 dotclear.php, 10 footer.php, 11 functions.php, 12...
CVE-2006-4743
WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for 1 404.php, 2 akismet.php, 3 archive.php, 4 archives.php, 5 attachment.php, 6 blogger.php, 7 comments.php, 8 comments-popup.php, 9 dotclear.php, 10 footer.php, 11 functions.php, 12...
CVE-2006-4735
CVE-2006-4735 pertains to MagpieRSS, where remote attackers can cause information disclosure by directly requesting (1) rss_fetch.inc.php or (2) rss_parse.inc.php, triggering error messages that disclose file paths. This is an information disclosure vulnerability in MagpieRSS that exposes interna...
CVE-2006-3938: Undefined Security Weakness
DotClear allows remote attackers to obtain sensitive information via a direct request for 1 editcat.php, 2 index.php, 3 editlink.php in ecrire/tools/blogroll/; 4 syslog/index.php, 5 thememng/index.php, 6 toolsmng/index.php, 7 utf8convert/index.php in /ecrire/tools/; 8 /ecrire/inc/connexion.php an...
DEBIAN-CVE-2006-3918
httpprotocol.c in 1 IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and 2 Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site...
security flaw
Multiple cross-site scripting XSS vulnerabilities in PHP 4.4.1 and 5.1.1, when displayerrors and htmlerrors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message...
phpBB 3 - memberlist.php SQL Injection
phpBB 3 - memberlist.php SQL Injection !/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$s...
phpBB 3 - 'memberlist.php' SQL Injection
!/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$s...
DEBIAN-CVE-2006-3389
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any...
ciscoXSS.txt
FUJITSU SERVICES SECURITY ADVISORY DATE: 27-01-2006 AUTHOR: THOMAS LIAM ROMANIS VENDOR: Cisco PRODUCT: Cisco Secure ACS VERSIONS TESTED: Cisco Secure ACS version 2.3 UNIX hosted on Netscape FastTrack Server version 2.01c on Sun Solaris 8.0 TITLE: Cisco Secure ACS LogonProxy.cgi Cross Site Scripti...
CVE-2006-2566
Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via 1 a quote character or possibly an invalid value in the action parameter in a request to mrarticles.php or 2 a login QUERYSTRING to admin.php without any additional parameters, which reveal the path in...
Cross site scripting
Cross-site scripting XSS vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and...
CVE-2006-2501
Cross-site scripting XSS vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and...
CVE-2006-2501
Cross-site scripting XSS vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and...
SAP Web Application Server crossite scripting
Crossite scripting with error messages...
Path traversal
Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium allows remote attackers to obtain full path information via 404 error messages. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2006-2355: Undefined Security Weakness
Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium allows remote attackers to obtain full path information via 404 error messages. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...