CVE-2004-2755

Cross-site scripting XSS vulnerability in Symantec Web Security 2.5, 3.0.0, and 3.0.1 before build 62 allows remote attackers to inject arbitrary web script or HTML via the query string in blocked URLs that are listed in 1 error or 2 block page messages...

CVE-2004-1837

Cross-site scripting XSS vulnerability in Modsurvey 3.0.x before 3.0.16-pre2 and 3.2.x before 3.2.0-pre4 allows remote attackers to inject arbitrary web script or HTML via the certain survey fields or error messages for malformed query strings...

CVE-2004-2058

ASPRunner 2.4 allows remote attackers to gain sensitive information via 1 hidden form fields or 2 error messages...

CVE-2004-1062: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in ViewCVS 0.9.2 allow remote attackers to inject arbitrary HTML and web script via certain error messages...

CVE-2004-1061: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error messages, as demonstrated using the action parameter...

CVE-2005-0066

The original design of TCP does not check that the TCP Acknowledgement number in an ICMP error message generated by an intermediate router is within the range of possible values for data that has already been acknowledged aka "TCP acknowledgement number checking", which makes it easier for...

CVE-2005-0067

The original design of TCP does not require that port numbers be assigned randomly aka "Port randomization", which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using 1 blind connection-reset attacks with...

CVE-2005-0068

The original design of ICMP does not require authentication for host-generated ICMP error messages, which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using 1 blind connection-reset attacks with forged...

CVE-2004-1226

SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to gain sensitive information via certain requests to scripts that contain invalid input, which reveals the path in an error message, as demonstrated using phprint.php with an empty module parameter...

[SA13408] Squid Malformed Host Name Error Message Information Leakage

TITLE: Squid Malformed Host Name Error Message Information Leakage SECUNIA ADVISORY ID: SA13408 VERIFY ADVISORY: http://secunia.com/advisories/13408/ CRITICAL: Less critical IMPACT: Exposure of system information, Exposure of sensitive information WHERE: From remote SOFTWARE: Squid 2.x...

CVE-2004-1105

The CVE-2004-1105 entry concerns Nortel Networks Contivity VPN Client, where the authentication error message varies depending on whether the username is valid, leading to partial information disclosure over a network. The NVD entry documents a Network-level vulnerability with a base score of 5.0...

CVE-2004-1105

Nortel Networks Contivity VPN Client displays a different error message depending on whether the username is valid or invalid, which could allow remote attackers to gain sensitive information...

squid -- possible information disclosure

The squid-2.5 patches pages notes: In certain conditions Squid returns random data as error messages in response to malformed host name, possibly leaking random internal information which may come from other requests...

Nortel Contivity VPN information leak

Messages for wrong username and wrong password are different...

Nortel Networks Contivity VPN Client information leakage vulnerability

Overview The Nortel Networks Contivity VPN Client authentication error message provide additional information that may be useful to an attacker. Description The Nortel Networks Contivity VPN Client software provides an encrypted and authenticated VPN connection from a client system to a Nortel...

Multiple vulnerabilities in ZanfiCmsLite

AuThor:Cracklove emA!l:CrackloveatGmaildotCom HoMePaGe:http://ProxySky.com Info Website: http://www.zanfi.nl Version: 1.1,The Newest Version Problem: Full path disclosure,Include file Vuls 1.Full path disclosure: Let's try to request like this: http://localhost/cms/admpages.php and we get standar...

Multiple vulnerabilities in BlackBoard

Multiple vulnerabilities in BlackBoard AuThor:Cracklove emA!l:CrackloveatGmaildotCom HoMePaGe:http://ProxySky.com Info Website: http://blackboard.unclassified.de Version: 1.5.1,Maybe prior Problem: Full path disclosure,Include file Vuls 1.Full path disclosure: Let's try to request like this:...

CVE-2002-1494

Cross-site scripting XSS vulnerabilities in Aestiva HTML/OS allows remote attackers to insert arbitrary HTML or script by inserting the script after a trailing / character, which inserts the script into the resulting error message...

CVE-2004-0662

PowerPortal 1.x allows remote attackers to gain sensitive information via invalid or missing parameters in HTTP requests to 1 resize.php or 2 modules.php, which reveals the path in an error message...

CVE-2004-0729

CVE-2004-0729 affects PhpBB 2.0.8. The vulnerability occurs when users supply invalid input via (1) category_rows to index.php, (2) faq to faq.php, or (3) ranksrow to profile.php, triggering error messages that reveal the full server path. The available documents confirm the component and origin ...