Lighttpd 1.4.15 - Multiple Code Execution / Denial of Service / Information Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/24967/info Lighttpd is prone to multiple remote denial-of-service vulnerabilities, a code-execution vulnerability, and an information-disclosure vulnerability. An attacker can exploit these issues to execute arbitrary code, access sensitive information, o...

CVE-2007-0805

The ps /usr/ucb/ps command on HP Tru64 UNIX 5.1 1885 allows local users to obtain sensitive information, including environment variables of arbitrary processes, via the "auxewww" argument, a similar issue to CVE-1999-1587...

CVE-2006-5316

registroTL stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for /usuarios.dat...

CVE-2006-4880

David Bennett PHP-Post PHPp 1.0 and earlier allows remote attackers to obtain sensitive information via a direct request for 1 footer.php, 2 template.php, or 3 lastvisit.php, which reveals the installation path in various error messages...

CVE-2006-3610

index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to obtain sensitive information partial database schema via a modified pagename parameter, which reflects portions of an SQL query in the result. NOTE: it is not clear whether the information is target-specific. If not, then this...

CVE-2006-3483

PHPMailList 1.8.0 stores sensitive information under the web document root iwth insufficient access control, which allows remote attackers to obtain email addresses of subscribers, configuration information, and the admin username and password via direct requests to 1 list.dat or 2 mlconfig.dat...

phpMyChat Information Disclosure

phpMyChat may allow an attacker to cause an information disclosure vulnerability allowing an attacker to cause the program to reveal the SQL username and password, the phpMyChat SPDX-FileCopyrightText: 2004 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and are...

CVE-2005-3050

PhpMyFaq 1.5.1 allows remote attackers to obtain sensitive information via a LANGCODE parameter that does not exist, which reveals the path in an error message...

CVE-2005-2999

PHP Advanced Transfer Manager 1.30 allows remote attackers to obtain sensitive PHP configuration information via a direct request to test.php...

several vulnerabilities present in Belkin wireless routers

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory name: several vulnerabilities present in Belkin wireless routers Overall severity rating: HIGH risk Devices affected: "belkin54g" family of wireless routers 4 main vulnerabilities are included in this advisory: - - default telnet backdoor - -...

Windows XP memory information leak

If WMI is used a part of RPC cache memory is not cleaned, making sensitive information leakage...

[SA15260] FreeBSD Insecure iir Driver Permissions

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: FreeBSD Insecure iir Driver Permissions SECUNIA ADVISO...

CVE-2001-1366

The vulnerability CVE-2001-1366 concerns netscript prior to 1.6.3, where parsing of dynamic variables could let remote attackers alter program behavior or access sensitive information. The description and linked references confirm the affected component and potential impact but do not provide exp...

CVE-2002-0228

CVE-2002-0228 affects Microsoft MSN Messenger. The vulnerability allows remote attackers to use Javascript referencing an ActiveX object to obtain sensitive information (e.g., display names, web site navigation) when the user is connected to certain Microsoft sites or DNS-spoofed sites. OpenVAS/O...

CVE-2001-0330

Bugzilla 2.10 contains a vulnerability where a remote attacker can access the database username and password by requesting the globals.pl file, which is served as plain text by the web server. The issue arises from exposing sensitive configuration data in a Perl CGI file. A fix is available in Bu...

CVE-2000-0110

CVE-2000-0110 affects the WebSiteTool shopping cart application, where remote attackers can modify sensitive purchase information by manipulating hidden form fields in the shopping cart. The PT-2000-1098 entry corroborates this description but does not specify affected versions or a fix. No explo...

CVE-2000-0008

The CVE-2000-0008 issue concerns FTPPro, where local users can read sensitive data stored in plain text. Connected sources (PT-1999-1817) name FTPPro and describe the vulnerability as allowing local access to plaintext information, but do not specify affected versions or a repair/fix. Other conne...