CVE-2002-2024

Horde IMP 2.2.7 is affected. The issue allows remote attackers to obtain the full web root pathname by requesting specific files (poppassd.php3, login.php3?reason=chpass2, spelling.php3, ldap.search.php3?ldap_serv=nonsense), with error messages leaking the information. Impact is information discl...

CVE-2002-2065

WebCalendar 0.9.34 and earlier is affected by an insecure include-file access vulnerability. When the product is built with “browsing in includes directory” enabled, remote attackers can read arbitrary .inc files from the web root. Root cause: insecure include-path handling allows reading local i...

CVE-2005-2229

Blog Torrent 0.92 and earlier stores sensitive files under the web document root in the 1 data or 2 torrents directories with insufficient access control, which allows remote attackers to obtain sensitive information such as account names and password hashes, as demonstrated using data/newusers...

fsboard 2.0 - Directory Traversal

fsboard 2.0 - Directory Traversal source: https://www.securityfocus.com/bid/14111/info FSboard is prone to a directory traversal vulnerability. This could allow a remote attacker to read files outside the Web root. This could only be used to access files to which the Web server has permission. Al...

fsboard 2.0 - Directory Traversal

source: https://www.securityfocus.com/bid/14111/info FSboard is prone to a directory traversal vulnerability. This could allow a remote attacker to read files outside the Web root. This could only be used to access files to which the Web server has permission. All versions of FSboard are vulnerab...

CVE-2002-1801

Vulnerability summary (CVE-2002-1801) ImageFolio versions 2.23 through 2.27 allow remote attackers to obtain sensitive information by querying a nonexistent image category, causing an error message that leaks the web root. This is the explicit impact described across multiple sources (NVD/Red Hat...

CVE-2002-1801

ImageFolio 2.23 through 2.27 allows remote attackers to obtain sensitive information via a nonexistent image category, which leaks the web root in the resulting error message...

CVE-2002-1677

14all.cgi 1.1p15 in mrtgconfig allows remote attackers to determine the physical path to the web root directory via a request with an invalid cfg parameter, which generates an error message that reveals the path...

CVE-2005-2029

amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file...

CVE-2005-1835

NEXTWEB iSite stores databases under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to databases/Users.mdb...

PT-2005-2802 · Nextweb · Nextweb Isite

Name of the Vulnerable Software and Affected Versions: NEXTWEB iSite affected versions not specified Description: The issue allows remote attackers to obtain sensitive information via a direct request to databases/Users.mdb due to insufficient access control. This is because databases are stored...

CVE-2005-1658

Directory traversal vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to list the parent directory of the web root via a URL with a "..." triple dot...

CVE-2005-1658

CVE-2005-1658 affects MyServer 0.8. A directory traversal flaw in filemanager.cpp allows remote attackers to list the parent directory of the web root by using a URL containing a triple dot ("..."). The NVD/CVE entries document this vulnerability with a CVSSv2 base score of 5.0 (AV:N/AC:L/Au:N/C:...

[SA15374] Ultimate Forum Exposure of Encrypted User Credentials

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: Ultimate Forum Exposure of Encrypted User Credentials...

CVE-2005-1595

CodeThat ShoppingCart 1.3.1 is affected by remote vulnerabilities described across connected sources. The OpenVAS NASL entry documents input validation flaws in the remote CodeThat ShoppingCart that allow SQL injection via the id parameter of catalog.php, enabling unauthenticated remote exploitat...

CVE-2005-1595

CodeThat ShoppingCart 1.3.1 stores config.ini under the web root, which allows remote attackers to obtain sensitive information via a direct request...

CVE-2005-1595

CodeThat ShoppingCart 1.3.1 stores config.ini under the web root, which allows remote attackers to obtain sensitive information via a direct request...

CVE-2005-1586

Quick.Forum 2.1.6 stores potentially sensitive information such as usernames, banned IP addresses, censored words, and backups under the web document root, which allows remote attackers to obtain that information via a direct request to 1 db/users.txt, 2 db/banList.txt, 3 db/censureWords.txt, or ...

CVE-2004-1786

PortalApp places user credentials under the web root with insufficient access control, which allows remote attackers to gain access to sensitive information via a direct request to 8275.mdb...

CVE-2004-1786

CVE-2004-1786 affects PortalApp and stems from insufficient access control that places user credentials under the web root. The vulnerability enables remote attackers to access sensitive information by directly requesting 8275.mdb. Connected sources confirm this exposure but do not document a pat...