4354 matches found
CVE-2006-2698
Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...
CVE-2006-2698
Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...
[KAPDA::#45] - geeklog multiple vulnerabilities
KAPDA New advisory Vendor: http://www.geeklog.net Bugs: Path Disclosure, XSS, SQL Injection Authentication bypass Vulnerable Version: geeklog-1.4.0sr2prior versions also may be affected Exploitation: Remote with browser Description: -------------------- geeklog is a freely available PHP-based web...
Sql injection
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...
CVE-2006-2565
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...
CVE-2006-2565
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...
[KAPDA::#43] - phpwcms multiple vulnerabilities
Vendor: http://www.phpwcms.de Bugs: Path Disclosure, XSS, Local File Inclusion, Remote Code Execution Vulnerable Version: phpwcms 1.2.5-DEV prior versions also maybe affected Exploitation: Remote with browser Description: -------------------- phpwcms is a web content management system optimized f...
Destiney Links Script v2.1.2
Destiney Links Script v2.1.2 - XSS Vulnv & Full path errors. Homepage: http://destiney.com/scripts Description: Destiney Links is an Open Source project written in PHP for use with the MySQL Server entity. Links provides a pre-built, dynamically generated, Link site. Links counts referrers in and...
CVE-2006-2535
CVE-2006-2535 affects the Destiney Links Script 2.1.2. The vulnerable component is index.php, where an invalid show parameter referencing a non-existent file leads to an error message that reveals the installation path. The notes suggest this could be related to a broader directory traversal issu...
CVE-2006-2534
Destiny Links Script 2.1.2 is vulnerable to information disclosure: remote attackers can obtain the installation path by direct URLs to files under include and themes/original. The issue stems from inadequate protection of library/support files. No exploit details or remediation are provided in t...
CVE-2006-2535
index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file, which reveals the path in the resulting error message. NOTE: this issue might be resultant from a more serious issue such as directory...
CVE-2006-2532
stats.php in Destiney Rated Images Script 0.5.0 allows remote attackers to obtain the installation path via an invalid s parameter, which displays the path in an error message. NOTE: this issue was originally claimed to be SQL injection, but CVE analysis shows that the problem is related to an...
CVE-2006-2532
The CVE-2006-2532 entry concerns Destiney Rated Images Script 0.5.0. The affected component is stats.php where an invalid s parameter can cause an error message to reveal the installation path. The description notes this was initially claimed to be SQL injection, but CVE analysis attributes the i...
Yourfreeworld.com Short Url & Url Tracker Script
This is the second script I've tested from these people. It will be assumed for right now that all of their scripts contain full path disclosure errors as well as XSS'ing Yourfreeworld.com Short Url & Url Tracker Script Homepage: http://www.yourfreeworld.com/script/shorturl.asp Short Url Service...
Myspace Friend Train v2.8
Myspace Friend Train v2.8 Full path disclosure & possible SQL injection. BRBR Its possible to put ' in the input myspace ID box to get the error. Example of the error is below: BRBR bInvalid query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server versio...
CVE-2006-2438
CVE-2006-2438 is a directory traversal in Resin’s viewfile servlet (resin-doc) affecting Resin 3.0.17 and 3.0.18. An unauthenticated remote attacker can read arbitrary files under other web roots via the contextpath parameter, with potential path disclosure when the parameter is invalid. The issu...
Resin < 3.0.19 Directory Traversal and Path Disclosure Vulnerabilities
Binary data 3621.prm...
CVE-2006-2355
The CVE-2006-2355 entry concerns Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium. Public sources state a path-information disclosure via 404 error messages, enabling remote attackers to obtain full path details. OpenVAS/Nessus entries corroborate that Ipswitch WhatsUp Pro...
90% of programs made in PHP5 and prior Full Path Disclosure vuln.
:Introduction: Normally one of the last steps when accessing to a web-server is to find the url where the web is installed more common in RFD. This may be a hard step, if the RPD is the only bug in that server, but PHP programs have functions that unexpectedly can return lots of errors. ATTENTION...
FreeBSD : postnuke -- multiple vulnerabilities (0274a9f1-0759-11da-bc08-0001020eed82)
Postnuke Security Announcementss reports of the following vulnerabilities : - missing input validation within /modules/Messages/readpmsg.php - possible path disclosure within /user.php - possible path disclosure within /modules/News/article.php - possible remote code injection within...