CVE-2011-3730: Exposure of Sensitive Information to an Unauthorized Actor

Drupal 7.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/simpletest/tests/upgrade/drupal-6.upload.database.php and certain other files...

CVE-2011-3729: Exposure of Sensitive Information to an Unauthorized Actor

dotproject 2.1.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by style/dp-grey-theme/footer.php and certain other files...

CVE-2011-3717: Exposure of Sensitive Information to an Unauthorized Actor

ClipBucket 2.0.9 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/signupcaptcha/signupcaptcha.php and certain other files...

CVE-2011-3750: Exposure of Sensitive Information to an Unauthorized Actor

kPlaylist 1.8.502 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by getid3/getid3/write.id3v1.php and certain other files...

CVE-2011-3696: Exposure of Sensitive Information to an Unauthorized Actor

60cycleCMS 2.5.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by post.php and certain other files...

CVE-2011-3720: Exposure of Sensitive Information to an Unauthorized Actor

conceptcms 5.3.1, 5.3.3, and possibly other versions allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by syslibs/umlib/umauthserver.inc.php and certain other files...

CVE-2011-3754: Exposure of Sensitive Information to an Unauthorized Actor

Mambo 4.6.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/sef.php and certain other files...

CVE-2011-3707: Exposure of Sensitive Information to an Unauthorized Actor

JanRain PHP OpenID library aka php-openid 2.2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Auth/Yadis/Yadis.php and certain other files...

PT-2011-4609

Name of the Vulnerable Software and Affected Versions CodeIgniter version 1.7.2 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message. For example, this can be...

CVE-2011-3697: Exposure of Sensitive Information to an Unauthorized Actor

Achievo 1.4.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/graph/jpgraph/jpgraphradar.php and certain other files...

CVE-2011-3695: Exposure of Sensitive Information to an Unauthorized Actor

111WebCalendar 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by footer.php and certain other files...

CVE-2011-3498: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in Progea Movicon / PowerHMI 11.2.1085 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long request...

CVE-2011-1665: Undefined Security Weakness

PHPBoost 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain backup SQL files via a direct request for predictable filenames in cache/backup/...

CVE-2011-0316: Undefined Security Weakness

The Administrative Console component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15 does not properly restrict access to console servlets, which allows remote attackers to obtain potentially sensitive status information via a direct request...

CVE-2010-4608: Exposure of Sensitive Information to an Unauthorized Actor

Habari 0.6.5 allows remote attackers to obtain sensitive information via a direct request to 1 header.php and 2 commentsitems.php in system/admin/, which reveals the installation path in an error message...

CVE-2010-4112: Exposure of Sensitive Information to an Unauthorized Actor

HP Insight Management Agents before 8.6 allows remote attackers to obtain sensitive information via an unspecified request that triggers disclosure of the full path...

CVE-2010-3615: Undefined Security Weakness

named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful requests for private DNS records via the standard DNS query mechanism...

CVE-2010-4234: Undefined Security Weakness

The web server on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to cause a denial of service device reboot via a large number of requests in a short time interval...

CVE-2010-3896: Improper Authentication

The ESSearchApplication directory tree in IBM OmniFind Enterprise Edition 8.x and 9.x does not require authentication, which allows remote attackers to modify the server configuration via a request to palette.do...

CVE-2010-2941: Use After Free

ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service use-after-free and application crash or possibly execute arbitrary code via a crafted IPP request...