CVE-2011-2152

The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for 1 Client/frmViewReports.aspx or 2 UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading a...

PT-2011-3401

Name of the Vulnerable Software and Affected Versions IBM Rational Build Forge version 7.1.0 Description The issue allows context-dependent attackers to discover session IDs by reading web-server access logs, web-server Referer logs, or the browser history. This is due to the use of the HTTP GET...

DeluxeBB 1.3 - Multiple Vulnerabilities

DeluxeBB 1.3 - Multiple Vulnerabilities Author: cp77fk4r | Empty0pagEShift+2gmail.com Vendor: http://www.deluxebb.com Directory Listing http://server/templates/ http://server/images/ http://server/logs/ http://server/wysiwyg/ http://server/docs/ http://server/classes http://server/lang...

Cross site request forgery (csrf)

weblogin/login.fcgi aka the WebLogin login script in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by reading 1 web-serve...

CVE-2009-3166

token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

CVE-2009-2945

CVE-2009-2945 affects Stanford WebAuth WebLogin (weblogin/login.fcgi) versions 3.5.5, 3.6.0, 3.6.1. The issue arises when a POST is converted to a GET, causing user passwords to appear in URLs that may be logged by web servers, stored in browser history, or included in Referer headers. This enabl...

Cisco CS-MARS information leak

User's password may be stored in server logs...

[SECURITY] Fedora 10 Update: awstats-6.8-3.fc10

Advanced Web Statistics is a powerful and featureful tool that generates advanced web server graphic statistics. This server log analyzer works from command line or as a CGI and shows you all information your log contai ns, in graphical web pages. It can analyze a lot of web/wap/proxy servers lik...

Design/Logic Flaw

Unspecified vulnerability in VMware Server before 1.0.4 causes user passwords to be recorded in cleartext in server logs, which might allow local users to gain privileges...

CVE-2007-5619

Unspecified vulnerability in VMware Server before 1.0.4 causes user passwords to be recorded in cleartext in server logs, which might allow local users to gain privileges...

CVE-2007-5619

Unspecified vulnerability in VMware Server before 1.0.4 causes user passwords to be recorded in cleartext in server logs, which might allow local users to gain privileges...

CVE-2007-5619: Undefined Security Weakness

Unspecified vulnerability in VMware Server before 1.0.4 causes user passwords to be recorded in cleartext in server logs, which might allow local users to gain privileges...

Authentication flaw

report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information web server logs via certain modified query parameters, as demonstrated using the profile, rid, prefs, n, vid, bd, ed, dt, and gtype parameters, a different vulnerability than CVE-2007-511...

CVE-2007-5113

report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information web server logs via certain modified query parameters, as demonstrated using the profile, rid, prefs, n, vid, bd, ed, dt, and gtype parameters, a different vulnerability than CVE-2007-511...

CVE-2007-5113

CVE-2007-5113 affects Google Urchin 5 (<= 5.7.03) where report.cgi allows remote attackers to bypass authentication and access sensitive information (web server logs) by modifying query parameters such as profile, rid, prefs, n, vid, bd, ed, dt, and gtype. The vulnerability is related to an au...

CVE-2007-5113: Improper Authentication

report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information web server logs via certain modified query parameters, as demonstrated using the profile, rid, prefs, n, vid, bd, ed, dt, and gtype parameters, a different vulnerability than CVE-2007-511...

eZ Publish <= 2.2.7 Multiple XSS Vulnerabilities

eZ Publish is prone to multiple cross-site scripting XSS vulnerabiliites. SPDX-FileCopyrightText: 2003 k-otik.com Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Bugzilla < 2.18.1 Multiple Information Disclosures

According to its banner, the remote host is running a version of Bugzilla that reportedly may include passwords in the web server logs because it embeds a user's password in a report URL if the user is prompted to log in while viewing a chart. It also allows users to learn whether an invisible...

CVE-2005-0435

awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog...

CVE-2005-0281

Cross-site scripting XSS vulnerability in the web interface in Soldner Secret Wars 30830 allows remote attackers to inject arbitrary web script or HTML via a user message, which is not filtered or quoted when the administrator views the server logs...