CVE-2006-0895

NOCC Webmail 1.0 is affected by CVE-2006-0895. A remote attacker can obtain the installation path by making a direct request to html/header.php, exposing information about the webroot. The available sources describe the vulnerability as a path disclosure that affects NOCC Webmail 1.0; no addition...

CVE-2006-0878

Noah's Classifieds 1.3 is affected by a path disclosure vulnerability in which remote attackers can obtain the installation path via a direct request to include files (example: classifieds/gorum/category.php). The root cause is a file inclusion/path traversal issue that exposes server paths. Vers...

NOCC Webmail <= 1.0 multiple vulnerabilities

------ NOCC Webmail = 1.0 multiple arbitrary local inclusion + ---------------- php injection - remote code execution / / cross site scripting / path disclosure -------------------------------------------------------------------------------- software: site: http://nocc.sourceforge.net/ descriptio...

[KAPDA::#29]Noah's classifieds multiple vulnerabilities

KAPDA New advisory Vendor: http://classifieds.phpoutsourcing.com Vulnerable: Noahs classifieds 1.3 and below classifieds component for mambo also may be affected Bug: Path Disclosure,Sql Injection,XSS,Local file inclusion,Remote code execution Exploitation: Remote with browser Exploit:available...

Invision Power Board 2.1.4 Multiple Vulnerabilities

/ -------------------------------------------------------- Neo Security Team NSTВ® - Advisory 16 - 18/02/06 -------------------------------------------------------- Program: Invision Power Board 2.1.4 Homepage: http://www.invisionboard.com Vulnerable Versions: 2.1.4 & Lower versions Risk: Low...

CVE-2006-0794

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0794

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Sql injection

SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis DFMSA, as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involvin...

CVE-2006-0727

SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis DFMSA, as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involvin...

CVE-2006-0727

SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis DFMSA, as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involvin...

CVE-2006-0727

CVE-2006-0727 describes a SQL injection in mstrack.php of MusOX DF MSAnalysis (DFMSA), used with CPG-Nuke Dragonfly CMS. An attacker can trigger path disclosure via a SQL syntax error and may be able to execute arbitrary SQL commands. The affected software is MusOX DF MSAnalysis as used in Dragon...

dotproject <= 2.0.1 remote code execution

dotproject = 2.0.1 remote code execution ====================================== Software: dotProject = 2.0.1 Severity: Arbitrary code execution, Path/Information Disclosure Risk: High Author: Robin Verton [email protected] Date: Feb. 14 2006 Vendor: dotproject.net contacted Description: dotProje...

dotProject-2.0.1.txt

dotproject Date: Feb. 14 2006 Vendor: dotproject.net contacted Description: dotProject is a volunteer supported Project Management application. Details: The 'protection.php' script does not properly validate user-supplied input in the 'siteurl' parameter. Some user-supplied input is not checked...

CVE-2006-0660

Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to 1 read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or 2 include arbitrary files via the template parameter to...

Directory traversal

Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to 1 read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or 2 include arbitrary files via the template parameter to...

Path traversal

MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax...

CVE-2006-0590

MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax...

CVE-2006-0590

MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax...

CVE-2006-0589

MyTopix 1.2.3 allows remote attackers to obtain the installation path via a direct request to logon.mod.php, which leaks the path in an error message...

CVE-2006-0590

The CVE-2006-0590 entry affects MyTopix 1.2.3, where a malformed hl parameter sent to index.php allows remote attackers to disclose the installation path. The underlying issue is described as path disclosure, with a note that it might be related to invalid SQL syntax. Public references in the rec...