CVE-2007-3556: Undefined Security Weakness

Liesbeth base CMS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an include file containing account credentials via a direct request for config.inc...

CVE-2007-3367: Undefined Security Weakness

Simple CGI Wrapper scgiwrap in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to obtain sensitive information via a direct request, which reveals the path in an error message. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2007-3146: Undefined Security Weakness

Zen Help Desk 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing a password via a direct request for ZenHelpDesk.mdb...

CVE-2007-3083: Undefined Security Weakness

Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...

CVE-2007-2979: Undefined Security Weakness

Techno Dreams Web Directory / Search Engine 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database.mdb...

CVE-2007-2944: Undefined Security Weakness

WabCMS 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/wabcmsn.mdb. NOTE: this issue was originally reported for "webCMS," but this was an error by an unreliable researcher...

CVE-2007-2945: Undefined Security Weakness

RMForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for rmforum.mdb...

CVE-2007-2590: Exposure of Sensitive Information to an Unauthorized Actor

Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allows remote attackers to obtain user names and other sensitive information via a direct request to 1 usrmgr/userList.asp or 2...

CVE-2007-2489: Undefined Security Weakness

Heap-based buffer overflow in LiveData Protocol Server 5.00.045, and other versions before update 500062 5.00.062, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted request for a WSDL file that causes a negative length to be used in a...

CVE-2007-2372: Undefined Security Weakness

admin/sendmod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and listid fields; and send...

CVE-2007-2147: Undefined Security Weakness

admin/options.php in Stephen Craton aka WiredPHP Chatness 2.5.3 and earlier does not check for administrative credentials, which allows remote attackers to read and modify the classes/vars.php and classes/varstuff.php configuration files via direct requests...

CVE-2007-2101: Undefined Security Weakness

FAC Guestbook 3.01 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/gbdb.mdb. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-1789: Undefined Security Weakness

Flyspray 0.9.9 allows remote attackers to obtain sensitive information private project summaries via direct requests...

CVE-2007-1647: Undefined Security Weakness

Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session sess files in...

CVE-2007-1480: Improper Authentication

Creative Guestbook 1.0 allows remote attackers to add an administrative account via a direct request to createadmin.php with Name, Email, and PASSWORD parameters set...

CVE-2007-1359: Undefined Security Weakness

Interpretation conflict in ModSecurity modsecurity 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ 0x00 byte, which modsecurity treats as a terminator even though it is still processed as normal data by some...

CVE-2007-1300: Undefined Security Weakness

DOURAN Software Technologies ISPUtil 3.32.84.1, and possibly earlier versions, stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and reseller data via a direct request for scripts/activesessions.ini. NOTE: the provenance...

CVE-2007-0915: Undefined Security Weakness

Distributed SLS daemon SLSd on HP-UX B.11.11 allows remote attackers to overwrite arbitrary files and gain privileges via a crafted RPC request...

CVE-2007-0928: Undefined Security Weakness

Virtual Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an encoded password via a direct request for pwd.txt...

CVE-2007-0894: Undefined Security Weakness

MediaWiki before 1.9.2 allows remote attackers to obtain sensitive information via a direct request to 1 Simple.deps.php, 2 MonoBook.deps.php, 3 MySkin.deps.php, or 4 Chick.deps.php in wiki/skins, which shows the installation path in the resulting error message...