Path disclosure

PMASA-2005-2 Announcement-ID: PMASA-2005-2 Date: 2005-02-26 Summary Path disclosure Description By calling some scripts that are part of phpMyAdmin in an unexpected way especially scripts in the libraries subdirectory, it is possible to trigger phpMyAdmin to display a PHP error message which...

phpWebSite 0.10.0 Full Path disclosure

/ -------------------------------------------------------- Neo Security Team NST® wWw.SoSvulnerable.NeT ® -------------------------------------------------------- Program: phpWebSite 0.10.0 Homepage: http://phpwebsite.appstate.edu Vulnerable Versions: All Risk: High!! Impact: Full Path disclosure...

zeroboardXSS.txt

".,-'^'-,..,-'^'-,..,-'^'-,..,-'^'-,..,-'^'-,..,- '^'-,.." ".,-- ,. -.,--,." ".,--,. ALBANIA SECURITY CLAN -.,--,." ".,-- ,. -.,--,." ".,-- ,. ...::www.albanianhaxorz.org::... -.,--,." ".,--,.- -.,--,." ".,--,.- PROUD TO BE ALBANIAN -.,--,." ".,-- ,. -.,--,." ".,--,. Long Live Ethnic Albania...

waraxe-2005-SA040.txt

================================================================================ waraxe-2005-SA040 ================================================================================ Full path disclosure and XSS in PhpNuke 6.x-7.6...

CVE-2005-0544

CVE-2005-0544 concerns phpMyAdmin 2.6.1. The affected component is phpMyAdmin’s web interface, where direct requests to 15 internal library/ini files (e.g., sqlvalidator.lib.php, select_lang.lib.php, setup.php, cookie.auth.lib.php, etc.) can trigger error messages that leak the server’s full path...

CVE-2005-0544

phpMyAdmin 2.6.1 allows remote attackers to obtain the full path of the server via direct requests to 1 sqlvalidator.lib.php, 2 sqlparser.lib.php, 3 selecttheme.lib.php, 4 selectlang.lib.php, 5 relationcleanup.lib.php, 6 headermetastyle.inc.php, 7 getforeign.lib.php, 8 displaytbllinks.lib.php, 9...

PHPBB 2.0.12 bug

PHPBB 2.0.12 is vulnable again to a path disclosure bug.And again the bug is in viewtopic.php.I wont repeat my firs submition so here is the bug: http://localhost/forum/viewtopic.php?t=4&highlight= As you can see you just need a valid topic.Here is a nother example:...

phpBB <= 2.0.11 Multiple Vulnerabilities

The remote host is running phpBB version 2.0.11 or older. Such versions suffer from multiple vulnerabilities: - full path display on critical messages. - full path disclosure in username handling caused by a PHP 4.3.10 bug. - arbitrary file disclosure vulnerability in avatar handling functions. -...

phpBB < 2.0.12 Path Disclosure / Unauthorized unlink() Function Access

Binary data 2641.prm...

bxcp0297.txt

Title: Local .php file inclusion and full path disclosure in BXCP = 0.2.9.7 Author: OfB|FistFucker Contact: http://www.ofb-clan.de/ ofb-clan at irc.quakenet.org:6667 1. Local .php file inclusion: --------------------------------- Because of no user input validation in 'index.php' it's possible to...

phpbb -- multiple information disclosure vulnerabilities

psoTFX reports: phpBB Group are pleased to announce the release of phpBB 2.0.12 the "Horray for Furrywood" release. This release addresses a number of bugs and a couple of potential exploits. ... one of the potential exploits addressed in this release could be serious in certain situations and th...

CVE-2004-1565

list.php in w-Agora 4.1.6a allows remote attackers to reveal the full path via a crafted HTTP request, possibly involving a malformed id parameter...

CVE-2004-1565

CVE-2004-1565 affects w-Agora 4.1.6a: list.php exposes the full server path via a crafted HTTP request to an id parameter (path disclosure). The connected Nessus entry notes multiple input validation issues in the remote software, including SQL injection and XSS vectors, but does not provide a pa...

phpbb 2.0.11 bug

PHPBB 2.0.11 is vulnable to a path disclosure.All you need is a valid topic and for highlight put .Here is a sample: http://www.site.com/forum/viewtopic.php?t=2&highlight= Here is the messege you will get: Warning: Compilation failed: missing at offset 7 in c:appservwwwforumviewtopic.php1109 :...

CVE-2005-0459

CVE-2005-0459 affects phpMyAdmin 2.6.2-dev (and possibly earlier) and allows remote attackers to discover the full web-root path by requesting select_lang.lib.php, causing a PHP error message that reveals the path. The vulnerability is due to error output disclosing the filesystem path; no exploi...

CVE-2005-0459

phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to selectlang.lib.php, which reveals the path in a PHP error message...

CVE-2005-0433

Php-Nuke 7.5 allows remote attackers to determine the full path of the web server via invalid or missing arguments to 1 db.php, 2 mainfile.php, 3 Downloads/index.php, or 4 WebLinks/index.php, which lists the path in a PHP error message...

CVE-2005-0443

index.php in CubeCart 2.0.4 allows remote attackers to 1 obtain the full path for the web server or 2 conduct cross-site scripting XSS attacks via an invalid language parameter, which echoes the parameter in a PHP error message...

CitrusDB 0.3.6 - 'uploadcc.php' Arbitrary Database Injection

source: https://www.securityfocus.com/bid/12557/info CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user...

CitrusDB 0.3.6 - 'importcc.php' CSV File SQL Injection

source: https://www.securityfocus.com/bid/12557/info CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user...