547 matches found
CVE-2007-5444: Exposure of Sensitive Information to an Unauthorized Actor
CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files...
CVE-2007-4873: Undefined Security Weakness
SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc...
CVE-2007-5026: Undefined Security Weakness
dBlog CMS, probably 2.0, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing an admin password hash via a direct request for dblog.mdb...
CVE-2007-4259: Undefined Security Weakness
EZPhotoSales 1.9.3 and earlier allows remote attackers to download arbitrary image files via 1 a direct request for a URL under OnlineViewing/galleries/ or 2 navigation of the gallery user interface with JavaScript disabled...
CVE-2007-4093: Undefined Security Weakness
Minb Is Not a Blog minb stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing usernames and encrypted passwords via a direct request for db/users.db...
CVE-2007-3626: Undefined Security Weakness
Unspecified vulnerability in the ADM daemon in Hitachi TPBroker before 20070706 allows remote attackers to cause a denial of service daemon crash via a certain request...
CVE-2005-4856: Undefined Security Weakness
The admin interface in eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051110 does not properly handle authorization errors, which allows remote attackers to obtain sensitive information and see the admin pagelayout and associated templates via a request with 1...
CVE-2007-3556: Undefined Security Weakness
Liesbeth base CMS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an include file containing account credentials via a direct request for config.inc...
CVE-2007-3367: Undefined Security Weakness
Simple CGI Wrapper scgiwrap in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to obtain sensitive information via a direct request, which reveals the path in an error message. NOTE: the provenance of this information is unknown; the details are obtained solely from...
CVE-2007-3146: Undefined Security Weakness
Zen Help Desk 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing a password via a direct request for ZenHelpDesk.mdb...
CVE-2007-3083: Undefined Security Weakness
Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...
CVE-2007-2979: Undefined Security Weakness
Techno Dreams Web Directory / Search Engine 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database.mdb...
CVE-2007-2945: Undefined Security Weakness
RMForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for rmforum.mdb...
CVE-2007-2944: Undefined Security Weakness
WabCMS 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/wabcmsn.mdb. NOTE: this issue was originally reported for "webCMS," but this was an error by an unreliable researcher...
CVE-2007-2590: Exposure of Sensitive Information to an Unauthorized Actor
Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allows remote attackers to obtain user names and other sensitive information via a direct request to 1 usrmgr/userList.asp or 2...
CVE-2007-2489: Undefined Security Weakness
Heap-based buffer overflow in LiveData Protocol Server 5.00.045, and other versions before update 500062 5.00.062, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted request for a WSDL file that causes a negative length to be used in a...
CVE-2007-2372: Undefined Security Weakness
admin/sendmod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and listid fields; and send...
CVE-2007-2147: Undefined Security Weakness
admin/options.php in Stephen Craton aka WiredPHP Chatness 2.5.3 and earlier does not check for administrative credentials, which allows remote attackers to read and modify the classes/vars.php and classes/varstuff.php configuration files via direct requests...
CVE-2007-2101: Undefined Security Weakness
FAC Guestbook 3.01 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/gbdb.mdb. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...