[Full-disclosure] Jetbox CMS version 2.1 Multiple Path Disclosure Vulnerabilities

netVigilance Security Advisory 27 Jetbox CMS version 2.1 Multiple Path Disclosure Vulnerabilities Description: Jetbox CMS is seriously tested on usability & has a professional intuitive interface. The system is role based, with workflow and module orientated. All content is fully separated from...

CVE-2006-7154

Iono allows remote attackers to obtain the full server path via certain requests to 1 templates/iono/admin/denied.tpl.php, 2 templates/iono/admin/index.tpl.php, and a other unspecified files in templates/...

CVE-2006-7154

The CVE concerns Iono: remote attackers can obtain the full server path by crafting requests to templates/iono/admin/denied.tpl.php, templates/iono/admin/index.tpl.php, and other files under templates/. The vulnerability description indicates a server path disclosure via file requests in the temp...

CVE-2006-7154: Undefined Security Weakness

Iono allows remote attackers to obtain the full server path via certain requests to 1 templates/iono/admin/denied.tpl.php, 2 templates/iono/admin/index.tpl.php, and a other unspecified files in templates/...

Spyce 2.1.3 - spyceexamplesrequest.spy?name Cross-Site Scripting

Spyce 2.1.3 - spyceexamplesrequest.spy?name Cross-Site Scripting source: https://www.securityfocus.com/bid/27898/info Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution. An attacker may leverage these issues to execu...

DEBIAN-CVE-2006-6943

PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to a scripts/checklang.php and b themes/darkblueorange/layout.inc.php; and via the 1 lang, 2 target, 3 db, 4 goto, 5 table, and 6 tblgroup array arguments to c index.php, and the 7 back argument t...

CVE-2006-6943

PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to a scripts/checklang.php and b themes/darkblueorange/layout.inc.php; and via the 1 lang, 2 target, 3 db, 4 goto, 5 table, and 6 tblgroup array arguments to c index.php, and the 7 back argument t...

CVE-2006-6943

PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to a scripts/checklang.php and b themes/darkblueorange/layout.inc.php; and via the 1 lang, 2 target, 3 db, 4 goto, 5 table, and 6 tblgroup array arguments to c index.php, and the 7 back argument t...

CVE-2006-6943

PhpMyAdmin prior to 2.9.1.1 is affected by a path-disclosure vulnerability. Remote attackers can obtain the full server path by making direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php, as well as by supplying any of the following arguments to index.php: ...

CVE-2006-6943

PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to a scripts/checklang.php and b themes/darkblueorange/layout.inc.php; and via the 1 lang, 2 target, 3 db, 4 goto, 5 table, and 6 tblgroup array arguments to c index.php, and the 7 back argument t...

CVE-2006-6943: Improper Input Validation

PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to a scripts/checklang.php and b themes/darkblueorange/layout.inc.php; and via the 1 lang, 2 target, 3 db, 4 goto, 5 table, and 6 tblgroup array arguments to c index.php, and the 7 back argument t...

CVE-2006-6273

spindex.php in Simple PHP Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid dir parameter, which reveals the path in an error message...

CVE-2006-6231

vuBB 0.2.1 and earlier allows remote attackers to obtain sensitive information via a direct request to includes/vubb.php, which leaks the path in an error message...

CVE-2006-5844

Speedywiki 2.0 is affected. The vulnerability allows remote attackers to disclose the web server’s full path by abusing the showRevisions[] and searchText[] parameters in index.php, and also via a direct request to upload.php with no parameters. This aligns with NVD data and PT Security’s advisor...

PT-2006-6518 · Speedywiki · Speedywiki

Name of the Vulnerable Software and Affected Versions: Speedywiki version 2.0 Description: The issue allows remote attackers to obtain the full path of the web server. This can be achieved via the showRevisions and searchText parameters in "index.php", and also through a direct request to...

CVE-2006-5759

index.php in Rhadrix If-CMS, possibly 1.01 and 2.07, allows remote attackers to obtain the full path of the web server via empty 1 rns or 2 pag arguments, which reveals the path in an error message...

CVE-2006-5759

The connected PT-2006-6440 entry confirms a path-disclosure vulnerability in Rhadrix If-CMS, affecting versions 1.01–2.07. The issue arises when empty arguments rns[] or pag[] are provided, causing an error message that reveals the web server’s full filesystem path. This can aid an attacker in lo...

PT-2006-6440 · Rhadrix · Rhadrix If-Cms

Name of the Vulnerable Software and Affected Versions: Rhadrix If-CMS versions 1.01 through 2.07 Description: The issue allows remote attackers to obtain the full path of the web server. This is achieved by providing empty arguments, specifically rns or pag, which results in an error message that...

CVE-2006-4899

The ePPIServlet script in Computer Associates CA eTrust Security Command Center 1.0 and r8 up to SP1 CR2, when running on Windows, allows remote attackers to obtain the web server path via a "'" single quote in the PIProfile function, which leaks the path in an error message...

CVE-2006-4899

The ePPIServlet script in Computer Associates CA eTrust Security Command Center 1.0 and r8 up to SP1 CR2, when running on Windows, allows remote attackers to obtain the web server path via a "'" single quote in the PIProfile function, which leaks the path in an error message...