Path traversal

WoltLab Community Framework WCF 1.0.6 in WoltLab Burning Board 3.0.5 allows remote attackers to obtain the full path via invalid 1 page and 2 form parameters, which leaks the path from an exception handler when a valid class cannot be found...

CVE-2007-3259

CVE-2007-3259 concerns Calendarix 0.7.20070307, where remote attackers can obtain sensitive information via multiple vectors: (1) invalid month[] on calendar.php, (2) invalid catview[] on cal_week.php during week operations, (3) invalid ycyear[] on yearcal.php, and (4) direct requests to cal_func...

CVE-2007-3171

Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the 1 smarty or 2 selectedtheme parameter, which reveals the path in various error messages...

CVE-2007-0690

myEvent 1.6 allows remote attackers to obtain sensitive information via 1 a Log In action without a password to login.php, or an invalid 2 view or 3 monthno parameter to myevent.php, which reveals the path in various error messages...

Path traversal

Advanced Guestbook 2.4.2 allows remote attackers to obtain sensitive information via an invalid 1 GBTBL parameter to a lang/codes-english.php or b image.php, which reveal the database name; 2 an invalid GBDB parameter to index.php, coupled with a ../index lang cookie, which reveals the installati...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

CVE-2006-3365

V3 Chat allows remote attackers to obtain the installation path via 1 an invalid id parameter to mail/index.php or 2 membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement...

Sql injection

Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...

Path traversal

ActiveCampaign SupportTrio 2.5 allows remote attackers to obtain the full path of the server via invalid 1 article or 2 print parameters in a kb action to index.php, or 3 an invalid category parameter to modules/KB/pdf.php, which leaks the path in an error message...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

Design/Logic Flaw

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2005-4490

Multiple cross-site scripting XSS vulnerabilities in SCOOP! 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 keyword and 2 invalid parameter to articleSearch.asp; 3 username and 4 invalid parameter to lostPassword.asp; 5 Username, 6 Password, and 7 invalid...

CVE-2005-2423

Beehive Forum allows remote attackers to obtain sensitive information via 1 an invalid finaluri or sortby parameter to index.php or a direct request to 2 admin.php, 3 attachments.inc.php, 4 banned.inc.php, 5 beehive.inc.php, 6 constants.inc.php, 7 db.inc.php, 8 dictionary.inc.php or 9...

CVE-2005-2423

Technical details are not publicly available in the provided documents. Monitor for updates from official advisories to obtain affected products, vulnerable components, impact, and remediation.

CVE-2005-0083

MySQL MaxDB 7.5.00 for Windows, and possibly earlier versions and other platforms, allows remote attackers to cause a denial of service application crash via invalid parameters to the 1 DBMCliString::ReallocString, 2 DBMCliString::operator, 3 DBMCliBuffer::ForceResize, 4...

CVE-2005-1147

CVE-2005-1147 affects CalendarScript 3.20’s calendar.pl, where remote attackers can trigger information disclosure through invalid (1) calendar or (2) template parameters. The issue leaks the full pathname and debug information, revealing sensitive data and indicating a flaw in input validation f...

CVE-2005-1148

calendar.pl in CalendarScript 3.21 allows remote attackers to obtain sensitive information via invalid 1 year or 2 month parameters, which leaks the full pathname and debug information...

CVE-2005-1148

CalendarScript 3.21's calendar.pl is vulnerable to information disclosure: remote attackers can trigger invalid year or month parameters to leak the full path and debug info. Affected: calendar.pl in CalendarScript 3.21. Root cause: improper handling of year/month input leads to leakage of filesy...

CVE-2005-1032

This CVE entry is rejected/not used; it does not represent an active vulnerability.

CVE-2005-0871

The CVE-2005-0871 entry describes a vulnerability in the Topic Calendar 1.0.1 module for phpBB. When run on Microsoft IIS, remote attackers can obtain sensitive information by supplying invalid parameters, which cause error messages to reveal the server path. The affected component is calendar_sc...