PT-2007-4304 · Php · Php

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 5.2.3 Description: The issue allows context-dependent attackers to determine the existence of arbitrary files by checking if the readfile function returns a string. This might also involve the realpath function...

Firefox information leak

It's possible to check file existance with resource:// URL...

[Full-disclosure] Uebimiau Webmail Multiple Vulnerabilities

Synopsis: Multiple Vulnerabilities Introduction: Uebimiau is an open source webmail interface. Details: Uebimiau doesn't correctly handle the $GET array in error.php. Many vulnerabilities have been already discovered, but I would like to introduce few new ones: 1 XSS 2 Three Web Server Directory...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure. OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is...

AZL-6778 CVE-2007-2768 affecting package openssh for versions less than 8.8p1-2

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

DEBIAN-CVE-2007-2768

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

AZL-35079 CVE-2007-2768 affecting package openssh for versions less than 9.5p1-2

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

CVE-2007-2539

CVE-2007-2539 affects RunCMS 1.5.2 and earlier, where the show_files function leads to information disclosure (revealing file existence and metadata) via unspecified vectors. The available sources describe this as a remote information disclosure vulnerability, but do not provide concrete exploit ...

CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication. OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different...

DEBIAN-CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...

PT-2007-3578 · Openssh +2 · Openssh +2

Name of the Vulnerable Software and Affected Versions: OpenSSH versions 4.6 and earlier Description: The issue allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY. This is because S/KEY displays a different response if the user account exist...

CVE-2007-0541

WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain...

DEBIAN-CVE-2007-0541

WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain...

CVE-2007-0541

WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain...

CVE-2004-2674

ArGoSoft FTP Server prior to 1.4.1.6 is affected by a directory traversal vulnerability that allows remote authenticated users to determine the existence of arbitrary files via .. sequences in the SITE UNZIP argument. The root cause is improper handling of path traversal in the SITE UNZIP command...

DEBIAN-CVE-2007-0109

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

WordPress <= 2.0.5 - Dictionnary & Bruteforce attack

In WordPress 2.0.5 and previous versions, there's a different error message if a user exists or not, which allows attackers to obtain sensitive information. Solution Update the WordPress to the latest available version at least 2.0.6...

CVE-2006-5966

Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to 1 reboot the system using the Reinicializar method in the ActiveScan.1 ActiveX control, or 2 determine arbitrary file existence and size via the ObtenerTamano method in the PAVPZ.SOS.1 ActiveX control...

CVE-2006-5966

Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to 1 reboot the system using the Reinicializar method in the ActiveScan.1 ActiveX control, or 2 determine arbitrary file existence and size via the ObtenerTamano method in the PAVPZ.SOS.1 ActiveX control...