1388 matches found
Improper access control
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests...
CVE-2006-0232
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests...
CVE-2006-1718
Magus Perde Clever Copy 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to view the database username and password via a direct request for connect.inc...
Information disclosure
gm-upload.cgi in Greymatter 1.3.1 allows remote authenticated users with upload privileges to execute arbitrary programs by uploading files to locations within the web root. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
[SA19423] Greymatter gm-upload.cgi File Upload Vulnerability
TITLE: Greymatter gm-upload.cgi File Upload Vulnerability SECUNIA ADVISORY ID: SA19423 VERIFY ADVISORY: http://secunia.com/advisories/19423/ CRITICAL: Less critical IMPACT: System access WHERE: From remote SOFTWARE: Greymatter 1.x http://secunia.com/product/1821/ DESCRIPTION: syst3mf4ult has...
Improper access control
PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/USERNAME file...
Improper access control
PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/USERNAME file...
CVE-2006-1207
PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/USERNAME file...
CVE-2006-1209
PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/USERNAME file...
CVE-2006-1207
PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/USERNAME file...
PT-2006-2223 · Php · Php Upload Center
Name of the Vulnerable Software and Affected Versions: PHP Upload Center affected versions not specified Description: The issue allows remote attackers to download password hashes due to insufficient access control. Specifically, password hashes are stored under the web root, making them accessib...
Improper access control
Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password...
CVE-2006-0843
Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password...
[SA18767] FCKeditor File Upload Vulnerability
TITLE: FCKeditor File Upload Vulnerability SECUNIA ADVISORY ID: SA18767 VERIFY ADVISORY: http://secunia.com/advisories/18767/ CRITICAL: Moderately critical IMPACT: System access WHERE: From remote SOFTWARE: FCKeditor 2.x http://secunia.com/product/7973/ DESCRIPTION: rgod has discovered a...
CVE-2006-0567
Directory traversal vulnerability in Files Xaraya module before 0.5.1, when the Archive Directory field on the Modify Config page is blank, allows remote attackers to access files outside of the web root via ".." dot dot sequences...
Directory traversal
Directory traversal vulnerability in Files Xaraya module before 0.5.1, when the Archive Directory field on the Modify Config page is blank, allows remote attackers to access files outside of the web root via ".." dot dot sequences...
CVE-2006-0567
Directory traversal vulnerability in Files Xaraya module before 0.5.1, when the Archive Directory field on the Modify Config page is blank, allows remote attackers to access files outside of the web root via ".." dot dot sequences...
[SA18648] CRE Loaded "files.php" File Upload Security Issue
TITLE: CRE Loaded "files.php" File Upload Security Issue SECUNIA ADVISORY ID: SA18648 VERIFY ADVISORY: http://secunia.com/advisories/18648/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: CRE Loaded 6.x http://secunia.com/product/7173/ DESCRIPTION: kaneda has discover...