CVE-2007-1647: Undefined Security Weakness

Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session sess files in...

CVE-2007-1480: Improper Authentication

Creative Guestbook 1.0 allows remote attackers to add an administrative account via a direct request to createadmin.php with Name, Email, and PASSWORD parameters set...

CVE-2007-1359: Undefined Security Weakness

Interpretation conflict in ModSecurity modsecurity 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ 0x00 byte, which modsecurity treats as a terminator even though it is still processed as normal data by some...

CVE-2007-1300: Undefined Security Weakness

DOURAN Software Technologies ISPUtil 3.32.84.1, and possibly earlier versions, stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and reseller data via a direct request for scripts/activesessions.ini. NOTE: the provenance...

CVE-2007-0915: Undefined Security Weakness

Distributed SLS daemon SLSd on HP-UX B.11.11 allows remote attackers to overwrite arbitrary files and gain privileges via a crafted RPC request...

CVE-2007-0928: Undefined Security Weakness

Virtual Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an encoded password via a direct request for pwd.txt...

CVE-2007-0894: Undefined Security Weakness

MediaWiki before 1.9.2 allows remote attackers to obtain sensitive information via a direct request to 1 Simple.deps.php, 2 MonoBook.deps.php, 3 MySkin.deps.php, or 4 Chick.deps.php in wiki/skins, which shows the installation path in the resulting error message...

CVE-2006-7000: Undefined Security Weakness

Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to 1 email/mail.php, 2 includes/init.php, 3 certain files in includes/cron/, and 4 jpgraph.php, 5 jpgraphbar.php, 6 jpgraphpie.php, and 7 jpgraphpie3d.php in includes/graph/, which leaks the path in...

CVE-2007-0149: Undefined Security Weakness

EMembersPro 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for users.mdb...

CVE-2007-0116: Undefined Security Weakness

Digger Solutions Intranet Open Source IOS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for data/intranet.mdb...

CVE-2007-0154: Undefined Security Weakness

Webulas stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/db.mdb...

CVE-2007-0075: Undefined Security Weakness

AspBB stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for db/aspbb.mdb...

CVE-2006-6890: Undefined Security Weakness

Voodoo chat 1.0RC1b stores sensitive information under the web root with insufficient access control, which allows remote attackers to download passwords via a direct request for data/users.dat...

CVE-2007-0096: Undefined Security Weakness

CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for DataBase/Carbon2.4d.mdb...

CVE-2006-6829: Undefined Security Weakness

Efkan Forum 1.0 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for forum.mdb. NOTE: The provenance of this information is unknown; the details are obtained solely from third par...

CVE-2006-6819: Undefined Security Weakness

AlstraSoft Web Host Directory stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a backup database via a direct request for admin/backup/db...

CVE-2006-6825: Undefined Security Weakness

Calendar MX BASIC 1.0.2 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for calendar.mdb. NOTE: The provenance of this information is unknown; the details are obtained solely fro...

CVE-2006-6658: Undefined Security Weakness

Inktomi Search 4.1.4 allows remote attackers to obtain sensitive information via direct requests with missing parameters to 1 help/header.html, 2 thesaurus.html, and 3 topics.html, which leak the installation path in the resulting error message, a related issue to CVE-2006-5970...

CVE-2006-6351: Undefined Security Weakness

KhaledMuratList stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 1 CL2F9R1A2C1N.mdb or 2 Data2F9R1A2C1N.mdb...

CVE-2006-6112: Undefined Security Weakness

LifeType 1.0.x and 1.1.x have insufficient access control for all of the PHP scripts under 1 class/ and 2 plugins/, which allows remote attackers to obtain the installation path via a direct request to any of the scripts, as demonstrated by a bayesianfilter.class.php and b bootstrap.php, which...