CVE-2002-1990

Vulnerability summary: CVE-2002-1990 affects Resin 2.0.5 through 2.1.2. The issue allows remote attackers to reveal physical path information by requesting the example Java class HelloServlet, enabling partial information disclosure. The available sources (NVD/Red Hat/CVE listings) confirm the af...

Path Disclosure and XSS problem in PHP Counter 7.2

Hi, I found two vulnerabillities in PHP Counter 7.2 PHP Counter Vendor: http://www.ekstreme.com/phplabs/phpcounter.php First an XSS problem file phpcounterxss.txt Second a Path disclosure vulnerabillity file phpcounterdir.txt. greets, priestmaster Mail: [email protected] URL:...

FreeBSD : phpbb -- privilege elevation and path disclosure (53e711ed-8972-11d9-9ff8-00306e01dda2)

The phpbb developer group reports : phpBB Group announces the release of phpBB 2.0.13, the 'Beware of the furries' edition. This release addresses two recent security exploits, one of them critical. They were reported a few days after .12 was released and no one is more annoyed than us, having to...

FreeBSD : phpmyadmin -- information disclosure vulnerability (a7062952-9023-11d9-a22c-0001020eed82)

A phpMyAdmin security announcement reports : By calling some scripts that are part of phpMyAdmin in an unexpected way especially scripts in the libraries subdirectory, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmi...

sile002adv.txt

---- sile002 advisory + PoC PRODUCT: PHP-Nuke VERSION: 7.5 but others versions maybe either vulnerables VENDOR: http://www.phpnuke.org VULNERABILITY: Multiple vulnerability RISK: Hight Found by: Silentium of Anacron Group Italy date: 02/05/2005 e-mail: anacrongroupitalyatautisticidotorg myhome:...

phpbb <=2.0.16 bug

?php / Installation Path Disclosure Vulnerability phpBB = 2.0.16 Example: if isset$HTTPPOSTVARS'mode' || isset$HTTPGETVARS'mode' $mode = isset$HTTPPOSTVARS'mode' ? $HTTPPOSTVARS'mode' : $HTTPGETVARS'mode'; $mode = htmlspecialchars$mode; else $mode = ''; If you get url like...

CVE-2004-2196

Zanfi CMS lite 1.1 allows remote attackers to obtain the full path of the web server via direct requests without required arguments to 1 admpages.php, 2 corrpages.php, 3 delblock.php, 4 delpage.php, 5 footer.php, 6 home.php, and others...

CVE-2004-2196

Affected product: Zanfi CMS lite 1.1. The vulnerability is a path disclosure issue where remote attackers can obtain the full path of the web server by directly requesting pages (1) adm_pages.php, (2) corr_pages.php, (3) del_block.php, (4) del_page.php, (5) footer.php, (6) home.php, and others. R...

pear-XML_RPC -- information disclosure vulnerabilities

The pear-XMLRPC release notes reports that the following issues has been fixed: Eliminate path disclosure vulnerabilities by suppressing error messages when eval'ing. Eliminate path disclosure vulnerability by catching bogus parameters submitted to XMLRPCValue::serializeval...

DEBIAN-CVE-2005-2110

WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via 1 a direct request to menu-header.php or a "1" value in the feed parameter to 2 wp-atom.php, 3 wp-rss.php, or 4 wp-rss2.php, which reveal the path in an error message. NOTE: vector 1 was later reported to al...

GLSA-200507-02 : WordPress: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200507-02 WordPress: Multiple vulnerabilities James Bercegay of the GulfTech Security Research Team discovered that WordPress insufficiently checks data passed to the XML-RPC server. He also discovered that WordPress has several...

CMSsimpleXSS.txt

CMS Made Simple is an open source project which uses the smarty template engine in various places. Its website is at http://cmsmadesimple.org while the smarty site is at http://smarty.php.net CMS Made Simple suffers from a Cross Site scripting XSS and path disclosure vulnerability;...

vcs100.txt

Donato Ferrante Application: Video Cam Server http://vcs.raybase.com/ Version: 1.0.0 Bugs: Multiple Vulnerabilities Date: 02-May-2005 Author: Donato Ferrante e-mail: [email protected] web: www.autistici.org/fdonato xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 1...

WordPress < 1.5.1.3 XMLRPC SQL Injection

The version of WordPress installed on the remote host is affected by a SQL injection vulnerability because the bundled XML-RPC library fails to properly sanitize user-supplied input to the 'xmlrpc.php' script. An attacker can exploit this flaw to launch SQL injection attacks that could lead to...

CVE-2002-1822

CVE-2002-1822 concerns IBM HTTP Server 1.0 on AS/400, where remote attackers can obtain the web root path and other sensitive information. The leak occurs via an error message when requesting a non-existent JSP page. The vulnerability is documented with a NVD CVSS v2 base score of 5.0 (Medium) an...

[ECHO_ADV_20$2005] Full path disclosure JAF CMS

--------------------------------------------------------------------------- ECHOADV20$2005 Full path disclosure JAF CMS --------------------------------------------------------------------------- Author: Dedi Dwianto Date: June, 23th 2005 Location: Indonesia, Jakarta Web:...

CVE-2002-1728

askSam Web Publisher 1.0 and 4.0 allows remote attackers to determine the full path to the web root directory via a request for a file that does not exist, which generates an error message that reveals the full path...

CVE-2002-1728

AskSam Web Publisher 1.0 and 4.0 are affected by a path disclosure vulnerability. The issue occurs when a user requests a non-existent file, causing an error message that reveals the full path to the web root directory. The accessible documents state this information exposure and do not provide e...

CVE-2002-1677

14all.cgi 1.1p15 in mrtgconfig allows remote attackers to determine the physical path to the web root directory via a request with an invalid cfg parameter, which generates an error message that reveals the path...

JBOSS 3.2.2-3.2.7 / 4.0.2 installation path disclosure / config disclosure / version fingerprinting

Security Advisory: JBOSS 3.2.2-3.2.7 / 4.0.2 installation path disclosure / config disclosure / version fingerprinting Date: 14/06/05 URL: http://www.illegalaccess.org/java/jbosspath.php Problem: The default installation of JBoss reveals the path of the installation directory and allows...