LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links which might allow remote attackers to obtain sensitive information via a crafted document which embeds data from local files into (1) Calc or (2) Writer.


IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via a REST API request.


Jazz

Team

Server

in

Jazz

Foundation

in

IBM

Rational

Collaborative

Lifecycle

Management

(CLM)

and

before

before

and

before

Rational

Quality

Manager

(RQM)

before

before

before

and

before

Rational

Team

Concert

(RTC)

before

before

before

and

before

Rational

Requirements

Composer

(RRC)

before

and

before

Rational

DOORS

Next

Generation

(RDNG)

before

before

and

before

Rational

Engineering

Lifecycle

Manager

(RELM)

through

through

and

before

Rational

Rhapsody

Design

Manager

(DM)

through

through

and

before

and

Rational

Software

Architect

Design

Manager

(DM)

through

through

and

before

uses

weak

permissions

for

unspecified

project

areas

which

allows

remote

authenticated

users

to

obtain

sensitive

information

via

unknown

vectors.


The Control and Provisioning functionality in Cisco Mobility Services Engine (MSE) 10.0(0.1) allows remote authenticated users to obtain sensitive information by reading log files aka Bug ID CSCut36851.


Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid credentials aka Bug IDs CSCue00833 and CSCub40331.


Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use of session identifiers as parameters with HTTP GET requests.


Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up button and leveraging an API in the GainSpan Wi-Fi module.


attic before 0.15 does not confirm unencrypted backups with the user which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to \unencrypted / without key file\.


The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39 5.5.x before 5.5.23 and 5.6.x before 5.6.7 does not verify that the uri property is a string which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type related to a \type confusion\ issue.


SAP Afaria does not properly restrict access to unspecified functionality which allows remote attackers to obtain sensitive information gain privileges or have other unspecified impact via unknown vectors SAP Security Note 2155690.


The web-based administrative interface in Cisco WebEx Meeting Center provides different error messages for failed login attempts depending on whether the username exists or corresponds to a privileged account which allows remote attackers to enumerate account names and obtain sensitive information via a series of requests aka Bug ID CSCuf28861.


Cisco WebEx Meeting Center does not properly determine authorization for reading a host calendar which allows remote attackers to obtain sensitive information by obtaining a list of all meetings and then sending a calendar request for each one aka Bug ID CSCur23913.


The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions and obtain sensitive information or change settings via unspecified vectors aka Bug ID CSCui72087.


The WebUI component in Blue Coat SSL Visibility Appliance SV800 SV1800 SV2800 and SV3800 3.6.x through 3.8.x before 3.8.4 does not include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie a different vulnerability than CVE-2015-2855.


Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2014-8450 CVE-2015-4450 CVE-2015-5088 CVE-2015-5089 and CVE-2015-5092.


The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5 6.5 before 6.5.7.1 and 6.6 before 6.6.2.1 forwards authentication challenges from upstream origin content servers (OCS) when used in an explicit proxy deployment which makes it easier for remote attackers to obtain sensitive information via a 407 (aka Proxy Authentication Required) HTTP status code as demonstrated when using NTLM authentication.


IBM SPSS Modeler 14.2 through FP3 IF027 15 through FP3 IF015 16 through FP2 IF012 17 through FP1 IF018 and 17.1 through IF008 includes unspecified cleartext data in memory dumps which allows local users to obtain sensitive information by reading a dump file.


The Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key which makes it easier for remote attackers to (1) obtain sensitive information by sniffing the network and (2) obtain access to the device by encrypting messages.


IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2 Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2 and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords in exception messages which allows physically proximate attackers to obtain sensitive information by reading GUI pop-up windows a different vulnerability than CVE-2015-6557.


The Configuration Log File component in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote authenticated users to obtain sensitive information by reading a log file aka Bug ID CSCuv12340.


EMC RSA Web Threat Detection before 5.1 SP1 stores a cleartext AnnoDB password in a configuration file which allows remote authenticated users to obtain sensitive information by reading this file.


The webGUI configuration-export feature in Cisco Edge Bluebird Operating System 1.2 on Edge 340 devices allows remote authenticated users to obtain sensitive information via unspecified vectors aka Bug ID CSCuu43968.


IBM InfoSphere Master Data Management - Collaborative Edition 9.1 10.1 11.0 before 11.0.0.0 IF11 11.3 before 11.3.0.0 IF7 and 11.4 before 11.4.0.4 IF1 does not properly restrict browser caching which allows local users to obtain sensitive information by reading cache files.


Mozilla Firefox OS before 2.2 does not require the wifi-manage privilege for reading a Wi-Fi system message which allows attackers to obtain potentially sensitive information via a crafted app.


in

IBM

Maximo

Asset

Management

through

before

and

before

Maximo

Asset

Management

before

and

before

for

SmartCloud

Control

Desk;

and

Maximo

Asset

Management

through

and

for

Tivoli

IT

Asset

Management

for

IT

and

certain

other

products

allows

remote

authenticated

users

to

obtain

sensitive

information

by

reading

a

backup

or

debug

application

file.


IBM

Tealeaf

Customer

Experience

before

before

and

before

before

before

and

before

does

not

encrypt

connections

between

internal

servers

which

allows

remote

attackers

to

obtain

sensitive

information

by

sniffing

the

network

for

HTTP

traffic.


The mailbox-restore feature in IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 6.1 before 6.1.3.6 6.3 before 6.3.1.3 6.4 before 6.4.1.4 and 7.1 before 7.1.0.2; Tivoli Storage FlashCopy Manager: FlashCopy Manager for Microsoft Exchange Server 2.1 2.2 3.1 before 3.1.1.5 3.2 before 3.2.1.7 and 4.1 before 4.1.1; and Tivoli Storage Manager FastBack for Microsoft Exchange 6.1 before 6.1.5.4 does not ensure that the correct mailbox is selected which allows remote authenticated users to obtain sensitive information via a duplicate alias name.


Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors a different vulnerability than CVE-2014-8450 CVE-2015-4449 CVE-2015-5088 CVE-2015-5089 and CVE-2015-5092.


D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the wireless key.


IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only weak TLS ciphers which might make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node.


Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext credentials which allows remote attackers to obtain sensitive information by sniffing the network.


SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI.


The InputAccel Database (IADB) installation process in EMC Captiva Capture 7.0 before patch 25 and 7.1 before patch 13 places a cleartext InputAccel (IA) SQL password in a DAL log file which allows local users to obtain sensitive information by reading a file.


Omron CX-One CX-Programmer before 9.6 uses a reversible format for password storage in project source-code files which makes it easier for local users to obtain sensitive information by reading a file.


drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18) as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors.


RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.


EMC PowerPath Virtual Appliance (aka vApp) before 2.0 has default passwords for the (1) emcupdate and (2) svcuser accounts which makes it easier for remote attackers to obtain potentially sensitive information via a login session.


IBM Content Collector for Email 3.0 before 3.0.0.6-IBM-ICC-Server-IF001 and 4.0 before 4.0.0.3-IBM-ICC-Server-IF001 does not properly handle an unspecified query operator during searches of IBM FileNet P8 systems with IBM Content Search Services which allows local users to bypass intended document-access restrictions and obtain sensitive information via a crafted search query.


The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field which allows remote attackers to obtain sensitive information by reading HTML source code.


Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception as demonstrated by pathname information.


D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the administrative password.


The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers which allows remote attackers to obtain sensitive information by reading web pages as demonstrated by MnT reports aka Bug ID CSCuq23140.


Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file which allows local users to obtain sensitive information by reading this file.


The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to obtain sensitive information by sniffing the network aka Bug ID CSCuq12117.


The kernel-mode drivers in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 do not properly initialize function buffers which allows local users to obtain sensitive information from kernel memory and possibly bypass the ASLR protection mechanism via a crafted application aka \Microsoft Windows Kernel Memory Disclosure Vulnerability.\


Cisco Headend System Release allows remote attackers to read temporary script files or archive files and consequently obtain sensitive information via a crafted header in an HTTP request aka Bug ID CSCus44909.


Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to obtain sensitive information via a file-inclusion attack aka Bug ID CSCup94744.


The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation related to a \Last-Level Cache Side-Channel Attack.\


The XMLAPI in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading return messages from crafted GET requests aka Bug ID CSCuj67079.


Omron CX-One CX-Programmer before 9.6 CJ2M PLC devices before 2.1 and CJ2H PLC devices before 1.5 rely on cleartext password transmission which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request.


powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and PowerKVM management which allows local users to obtain sensitive information by listing the process.


mod/lti/ajax.php in Moodle through 2.5.9 2.6.x before 2.6.7 2.7.x before 2.7.4 and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches which allows remote authenticated users to obtain sensitive information via requests to the LTI Ajax service.


EMC Documentum xCelerated Management System (xMS) 1.1 before P14 stores cleartext Windows Service credentials in a batch file during Documentum Platform and xCelerated Composition Platform (xCP) provisioning which allows local users to obtain sensitive information by reading a file.


The Java overlay feature in IBM Bluemix Liberty before 1.13-20150209-1122 for Java does not properly support WAR applications which allows remote attackers to obtain sensitive information via unspecified vectors.


The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs which allows remote authenticated users to obtain sensitive information or modify data via unspecified API calls.


The Ogaki Kyoritsu Bank Smartphone Passbook application 1.0.0 for Android creates a log file containing input data from the user which allows attackers to obtain sensitive information by reading a file.


The D2-API component in EMC Documentum D2 3.1 through SP1 4.0 and 4.1 before 4.1 P22 and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files which allows remote authenticated users to obtain sensitive information by reading a file.


Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup which allows local users to obtain sensitive information by reading files in the directory.


Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files which makes it easier for local users to obtain sensitive information by discovering this password.


Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials which allows local users to obtain sensitive information via unspecified vectors.


The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data which allows remote authenticated users to obtain sensitive information via unspecified vectors.


The UIKit View component in Apple iOS before 8.3 displays unblurred application snapshots in the Task Switcher which makes it easier for physically proximate attackers to obtain sensitive information by reading the device screen.


The private-browsing implementation in WebKit in Apple Safari before 6.2.5 7.x before 7.1.5 and 8.x before 8.0.5 places browsing history into an index which might allow local users to obtain sensitive information by reading index entries.


The installer in IBM InfoSphere Information Server 8.5 through 11.3 before 11.3.1.2 allows local users to obtain sensitive information via unspecified commands.


Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt credentials which allows local users to obtain sensitive information by reading a file and conducting a decryption attack.


MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option which allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used.


/usr/lpp/mmfs/bin/gpfs.snap in IBM General Parallel File System (GPFS) 4.1 before 4.1.0.7 produces an archive potentially containing cleartext keys and lacks a warning about reviewing this archive to detect included keys which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.


Apple Safari before 6.2.5 7.x before 7.1.5 and 8.x before 8.0.5 as used on iOS before 8.3 and other platforms does not properly delete browsing-history data from the history.plist file which allows attackers to obtain sensitive information by reading this file.


Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext which allows remote administrators to obtain sensitive information by reading the log at debug/startup/.


The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.


The Dealer Portal in SAP ERP does not properly restrict access which allows remote attackers to obtain sensitive information gain privileges and possibly have other unspecified impact via unknown vectors aka SAP Note 2000401. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04 before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10 before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information or access files with root permissions.


The

SearchEngineTabHelper::OnPageHasOSDD

function

in

in

Google

Chrome

before

does

not

prevent

use

of

a

file:

URL

for

an

OpenSearch

descriptor

XML

document

which

might

allow

remote

attackers

to

obtain

sensitive

information

from

local

files

via

a

crafted

http

or

https

web

site.


The Siemens SPCanywhere application for Android does not properly store application passwords which allows physically proximate attackers to obtain sensitive information by examining the device filesystem.


Screen Sharing in Apple OS X before 10.10.3 stores the password of a user in a log file which might allow context-dependent attackers to obtain sensitive information by reading this file.


IniNet embeddedWebServer (aka eWebServer) before 2.02 for Windows CE uses cleartext for password storage which allows context-dependent attackers to obtain sensitive information via unspecified vectors.


IBM

Java

before

before

before

before

and

before

allows

remote

attackers

to

bypass

\permission

checks\

and

obtain

sensitive

information

via

vectors

related

to

the

Java

Virtual

Machine.


The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors.


Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage which allows local users to obtain sensitive information by reading a file.


Omron CX-One CX-Programmer before 9.6 CJ2M PLC devices before 2.1 and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash cards which makes it easier for local users to obtain sensitive information by reading a file.


IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 places session IDs in https URLs which allows remote attackers to obtain sensitive information by reading (1) web-server access logs (2) web-server Referer logs or (3) the browser history.


IBM Tivoli Security Directory Server 6.0 before iFix 75 6.1 before iFix 68 6.2 before iFix 44 6.3 before iFix 37 6.3.1 before iFix 11 and 6.4 before iFix 2 does not properly restrict encrypted files which allows local users to obtain sensitive information or possibly have unspecified other impact via a (1) download or (2) upload action.


The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.


Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled which allows local users to obtain sensitive information by reading the file.


The Windows DirectWrite library as used in Microsoft .NET Framework 3.0 SP2 3.5 3.5.1 4 4.5 4.5.1 and 4.5.2 allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site aka \OpenType Font Parsing Vulnerability.\


The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restrictions.


The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information.


RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the (1) update_repo (2) get_locks or (3) get_user_groups API method.


Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates which allows remote attackers to obtain sensitive information by sniffing the network.


IBM WebSphere Application Server 7.x before 7.0.0.39 8.0.x before 8.0.0.11 and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header.


The

FrameFetchContext::updateTimingInfoForIFrameNavigation

function

in

in

Blink

as

used

in

Google

Chrome

before

does

not

properly

restrict

the

availability

of

IFRAME

Resource

Timing

API

times

which

allows

remote

attackers

to

obtain

sensitive

information

via

crafted

JavaScript

code

that

leverages

a

history.back

call.


IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink as used in Google Chrome before 44.0.2403.89 does not properly choose a truncation point which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack.


The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.


Xen 4.2.x through 4.5.x does not initialize certain fields which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.


sharenfs 0.6.4 when built with commits bcdd594 and 7d08880 from the zfs repository provides world readable access to the shared zfs file system which might allow remote authenticated users to obtain sensitive information by reading shared files.


The Views module before 6.x-2.18 6.x-3.x before 6.x-3.2 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to the default views configurations which allows remote authenticated users to obtain sensitive information via unspecified vectors.


ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring which allows local users to obtain sensitive information by reading the file.


Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound (2) /proc/timer_stats (3) /proc/latency_stats and (4) /proc/fs which allows local users to modify the host obtain sensitive information and perform protocol downgrade attacks via a crafted image.


The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh 1.0.0 before 1.0.0t 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.


XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system.


REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords which allows local users to obtain sensitive information by reading the log.


Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux Adobe AIR before 18.0.0.180 Adobe AIR SDK before 18.0.0.180 and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.


The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.


The snprintf implementation in PostgreSQL before 9.0.20 9.1.x before 9.1.16 9.2.x before 9.2.11 9.3.x before 9.3.7 and 9.4.x before 9.4.2 does not properly handle system-call errors which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors as demonstrated by an out-of-memory error.


The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8 7.x before 7.1.8 and 8.x before 8.0.8 as used in iOS before 8.4.1 and other products does not properly restrict cookie transmission for report requests which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.


Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux Adobe AIR before 17.0.0.172 Adobe AIR SDK before 17.0.0.172 and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.


SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors aka SAP Security Note 2084037.


Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files which allows local users to obtain sensitive information by searching unallocated disk space.


The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0 when used in portlets with the default resource serving for GenericPortlet does not properly restrict access to restricted resources which allows remote attackers to obtain sensitive information via a URL with a modified resource ID.


Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules which allows remote authenticated users to obtain sensitive information via a subscription request.


RLE Nova-Wind Turbine HMI devices store cleartext credentials which allows remote attackers to obtain sensitive information via unspecified vectors.


Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.


cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name which allows remote attackers to obtain sensitive information via unspecified vectors.


The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application.


node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.


Microsoft

Windows

Vista

Windows

Server

and

Windows

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Gold

and

Windows

Excel

PowerPoint

Visio

Word

Office

Excel

PowerPoint

Visio

Word

Excel

PowerPoint

Visio

Word

Excel

RT

PowerPoint

RT

Visio

RT

Word

RT

and

Internet

Explorer

through

allow

remote

attackers

to

gain

privileges

and

obtain

sensitive

information

via

a

crafted

command-line

parameter

to

an

Office

application

or

Notepad

as

demonstrated

by

a

transition

from

Low

Integrity

to

Medium

Integrity

aka

\Unsafe

Command

Line

Parameter

Passing

Vulnerability.\


Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization which allows remote attackers to obtain sensitive information modify passwords or remove accounts by leveraging the guest role.


Netty before 3.9.8.Final 3.10.x before 3.10.3.Final 4.0.x before 4.0.28.Final and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.


The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.


The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header aka JetLeak.


Mozilla Firefox before 38.0 on Android does not properly restrict writing URL data to the Android logging system which allows attackers to obtain sensitive information via a crafted application that has a required permission for reading a log as demonstrated by the READ_LOGS permission for the mixed-content violation log on Android 4.0 and earlier.


Mozilla Firefox before 39.0 on OS X includes native key press information during the logging of crashes which allows remote attackers to obtain sensitive information by leveraging access to a crash-reporting data stream.


The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures which allows local guest users to obtain sensitive information via unspecified vectors.


Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a URL as demonstrated by a private path component.


Unspecified vulnerability in Powershell Operations in HP Operations Orchestration 9.x and 10.x allows remote authenticated users to obtain sensitive information via unknown vectors.


HP Systems Insight Manager (SIM) before 7.5.0 as used in HP Matrix Operating Environment before 7.5.0 and other products allows remote authenticated users to obtain sensitive information via unspecified vectors a different vulnerability than CVE-2015-5403.


net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.


The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive information via a crafted UDS patch with JavaScript.


The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7 7.5 through 7.5.0.5 and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password which allows local users to obtain sensitive information by reading this file.


Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477 3.6.x before 3.6.1217 3.7.x before 3.7.1248 3.8.x before 3.8.1263 and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct request to the (1) system log URL (2) whitelist URL or (3) blacklist URL.


SysAid Help Desk before 15.2 uses a hardcoded encryption key which makes it easier for remote attackers to obtain sensitive information as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml.


iBaby M6 allows remote attackers to obtain sensitive information related to the ibabycloud.com service.


The Yodobashi application 1.2.1.0 and earlier for Android allows remote attackers to execute arbitrary Java methods and consequently obtain sensitive information or execute OS commands via a crafted HTML document.


The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory which allows local users to obtain sensitive information by reading the memory.


The Auditing service in SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information by reading an audit event aka SAP Note 2011395.


The Mail Server in Websense TRITON AP-EMAIL and V-Series appliances before 8.0.0 uses plaintext credentials which allows remote attackers to obtain sensitive information via unspecified vectors.


Evergreen

before

before

and

before

allows

remote

attackers

to

bypass

an

intended

access

restriction

and

obtain

sensitive

information

about

org

unit

settings

by

leveraging

failure

of

open-ils.actor.ou_setting.ancestor_default

to

enforce

when

no

auth

token

is

provided.


The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to obtain sensitive information modify the database or possibly have other unspecified impact via a crafted URL.


The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document.


Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/ which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Security incident report or the (2) Explorer configuration (websense.ini) file.


IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the correct security profile is selected which allows remote authenticated users to obtain sensitive information via unspecified vectors.


The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters aka SAP Security Note 2091768.


WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.


Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request related to yoics.net URLs stream.m3u8 URIs and cam_service_enable.cgi.


IBM Tivoli Security Directory Server 6.0 before iFix 75 6.1 before iFix 68 6.2 before iFix 44 6.3 before iFix 37 6.3.1 before iFix 11 and 6.4 before iFix 2 does not prevent caching of documents retrieved in SSL sessions which allows physically proximate attackers to obtain sensitive information by leveraging an unattended workstation.


net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.


Cloudera Manager 4.x 5.0.x before 5.0.6 5.1.x before 5.1.5 5.2.x before 5.2.5 and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager which allows local users to obtain sensitive information by reading the files as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process.


The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19 2.4.x before 2.4.18 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range which triggers an out-of-bounds heap read.


The Issues API in Redmine before 2.6.8 3.0.x before 3.0.6 and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.


NetApp SnapDrive for Windows before 7.0.2P4 7.0.3 and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive information via unspecified vectors.


The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.


The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.


The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization which allows remote authenticated users to obtain sensitive information gain privileges or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp (2) webcontent/cas/cas_validate.jsp or (3) webcontent/aas/aas_store.jsp aka SAP Security Note 1945215.


The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string which triggers an invalid memory access.


ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain versions of systemd which allows local users to obtain sensitive information via unspecified vectors.


The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data which triggers an out-of-bounds heap read.


The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data which allows local users to obtain sensitive information by reading the file.


The EbmlElement::ReadCodedSizeValue function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted length value in an EBML id which triggers an invalid memory access.


The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator accounts via a modified request.


app/views/journals/index.builder in Redmine before 2.6.9 3.0.x before 3.0.7 and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.


Xen 4.6.x 4.5.x 4.4.x 4.3.x and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.


Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication which allows remote attackers to obtain sensitive information modify settings or manage build agents via unknown vectors involving the JMS port.


Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file which allows local users to obtain sensitive information by pasting the contents to another file.


app/views/timelog/_form.html.erb in Redmine before 2.6.8 3.0.x before 3.0.6 and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.


The API on Fisher-Price Smart Toy Bear devices allows remote attackers to obtain sensitive information or modify data by leveraging presence in an 802.11 network's coverage area and entering an account number.


The Web Server component in TIBCO LogLogic Unity before 1.1.1 allows remote authenticated users to gain privileges and consequently obtain sensitive information via an HTTP request.


Atlassian JIRA Software 7.0.3 JIRA Core 7.0.3 and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with inline wiki markup referencing an image attachment which might allow remote attackers to obtain sensitive information by updating a different issue that includes wiki markup for an external image reference.


The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token which embeds a rendered entity in the main node.


The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances which might allow remote attackers to obtain sensitive information from the anonymous user profile via unspecified vectors.


Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.


The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local users to obtain sensitive information from kernel memory by reading a tty data structure.


arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3 as used in the ION subsystem in Android and other products does not initialize certain data structures which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call.


Huawei VCN500 with software before V100R002C00SPC201 logs passwords in cleartext which allows remote authenticated users to obtain sensitive information by triggering log generation and then reading the log.


libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12 4.4.x before 4.4.15.2 and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request which reveals the full path in an error message.


mediaserver in Android before 5.1.1 LMY48X allows remote attackers to obtain sensitive information and consequently bypass an unspecified protection mechanism via unknown vectors aka internal bugs 23540907 and 23515142 a different vulnerability than CVE-2015-6611.


pcregrep in PCRE before 8.38 mishandles the -q option for binary files which might allow remote attackers to obtain sensitive information via a crafted file as demonstrated by a CGI script that sends stdout data to a client.


The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view which allows remote attackers to obtain sensitive information via an unspecified URL pattern.


tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal which allows local users to obtain sensitive information by reading the file.


The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML lacing which triggers an invalid memory access.


The ioresources_init function in kernel/resource.c in the Linux kernel through 4.7 as used in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices uses weak permissions for /proc/iomem which allows local users to obtain sensitive information by reading this file aka Android internal bug 28814213 and Qualcomm internal bug CR786116. NOTE: the permissions may be intentional in most non-Android contexts.


Template.pm in Bugzilla 2.x 3.x and 4.x before 4.2.16 4.3.x and 4.4.x before 4.4.11 and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files which allows remote attackers to obtain sensitive information by leveraging a web browser that interprets CSV data as JavaScript code.


The

ThemeMakers

SmartIT

Premium

Responsive

theme

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


The

ThemeMakers

Car

Dealer

Auto

Dealer

Responsive

theme

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


The

ThemeMakers

Axioma

Premium

Responsive

theme

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


The

ThemeMakers

Invento

Responsive

Gallery/Architecture

Template

component

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


The

ThemeMakers

Almera

Responsive

Portfolio

theme

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points because they do not have ACLs by default.


The

ThemeMakers

Diplomat

Political

theme

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitive information because the content of a privately published post is sent in JSON format.


The

ThemeMakers

Accio

Responsive

Parallax

One

Page

Site

Template

component

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


The

ThemeMakers

Blessing

Premium

Responsive

theme

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


The

ThemeMakers

Goodnex

Premium

Responsive

theme

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


The

ThemeMakers

GamesTheme

Premium

theme

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


The

ThemeMakers

Almera

Responsive

Portfolio

Site

Template

component

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data software versions configuration and virtual machines via a request to a Web Virtual Directory.


The

ThemeMakers

Accio

One

Page

Parallax

Responsive

theme

through

for

WordPress

allows

remote

attackers

to

obtain

sensitive

information

(such

as

and

values)

via

a

direct

request

for

the

URI.


JaguarEditControl (JEdit) ActiveX Control 1.1.0.20 and earlier allows remote attackers to obtain sensitive information such as the username and MAC and IP addresses by setting the test field to certain values such as 2404 or 2790 then reading the information from the .JText field.


Free Realty before 2.9 allows remote attackers to obtain the full path and other sensitive information via unspecified manipulations that produce an error message.


The dynamic linker (dyld) in Apple Mac OS X 10.3.9 allows local users to obtain sensitive information via unspecified dynamic linker options that affect the use of standard error (stderr) by privileged applications.


index.php in Vincent Leclercq News 5.2 allows remote attackers to obtain sensitive information such as the installation path via a mail parameter with invalid values.


index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty (1) _GET (2) _SESSION (3) _POST (4) _COOKIE or (5) _SESSION array parameters which reveals the installation path in an error message. NOTE: this issue might be resultant from a global overwrite vulnerability.


post.php in x_atrix xGuestBook 1.02 allows remote attackers to obtain sensitive information via a request without the (1) user (2) mail (3) p or (4) url parameter which reveals the installation path in an error message.


The Backup selection in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier uses predicable filenames for database backups and stores the files under the web root with insufficient access control which allows remote attackers to obtain sensitive information by downloading a backup file.


Mp3 JudeBox Server (Mp3NetBox) Beta 1 stores config.inc under the web document root with insufficient access control which allows remote attackers to obtain sensitive information including the database configuration.


HTTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain usernames and directory paths via a direct URL request.


MT Orumcek Toplist 2.2 stores DB/orumcektoplist.mdb under the web root with insufficient access control which allows remote attackers to obtain sensitive information via a direct request.


Banex PHP MySQL Banner Exchange 2.21 stores lib.inc under the web document root with insufficient access control which allows remote attackers to obtain sensitive information such as database usernames and passwords.


The showtopic module in Koobi Pro CMS 5.6 allows remote attackers to obtain sensitive information via a ' (single quote) in the p parameter which displays the path in an error message. NOTE: it is not clear whether this is SQL injection or a forced SQL error.


secure/ConfigureReleaseNote.jspa in Atlassian JIRA 3.6.2-#156 allows remote attackers to obtain sensitive information via unspecified manipulations of the projectId parameter which displays the installation path and other system information in an error message.


The privoxy configuration file in Tor before 0.1.1.20 when run on Apple OS X logs all data via the \logfile\ which allows attackers to obtain potentially sensitive information.


CS-Forum before 0.82 allows remote attackers to obtain sensitive information via unspecified manipulations possibly involving an empty collapse or readall parameter to index.php which reveals the installation path in an error message.


index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information such as SQL table prefixes via an invalid paged parameter which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.


Cisco Security Monitoring Analysis and Response System (CS-MARS) before 4.2.1 ships with an Oracle database that contains several default accounts and passwords which allows attackers to obtain sensitive information.


Blueboy 1.0.3 stores bb_news_config.inc under the web document root with insufficient access control which allows remote attackers to obtain sensitive information including the database configuration.


Efone 20000723 stores config.inc under the web document root with insufficient access control which allows remote attackers to obtain sensitive information.


DotClear

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

for

index.php

in

ecrire/tools/blogroll/;

syslog/index.php

thememng/index.php

toolsmng/index.php

in

and

class.blog.php

class.blogcomment.php

and

class.blogpost.php

in

append.php

class.xblog.php

class.xblogcomment.php

and

class.xblogpost.php

in

/layout/;

form.php

list.php

post.php

or

template.php

in

which

reveal

the

installation

path

in

error

messages.


The \change password forms\ in Taskjitsu before 2.0.1 includes password hashes in hidden form fields which allows remote attackers to obtain sensitive information from the (1) Category Editor and (2) User Information editor.


Eupla Foros 1.0 stores the inc/config.inc file under the web document root with insufficient access control which allows remote attackers to obtain sensitive information including the database configuration.


Kamikaze-QSCM 0.1 stores config.inc under the web document root with insufficient access control which allows remote attackers to obtain sensitive information including the database configuration.


requirements.php in Dating Agent PRO 4.7.1 allows remote attackers to obtain sensitive information via a direct request which calls the phpinfo function.


PHPMailList 1.8.0 stores sensitive information under the web document root iwth insufficient access control which allows remote attackers to obtain email addresses of subscribers configuration information and the admin username and password via direct requests to (1) list.dat or (2) ml_config.dat.


FLV Players 8 allows remote attackers to obtain sensitive information via (1) a direct request to paginate.php or (2) an invalid p parameter to player.php which reveal the path in an error message.


index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to obtain sensitive information (partial database schema) via a modified page_name parameter which reflects portions of an SQL query in the result. NOTE: it is not clear whether the information is target-specific. If not then this issue is not an exposure.


NmConsole/utility/RenderMap.asp in Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain sensitive information about network nodes via a modified nDeviceGroupID parameter.


Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via (1) a quote character or possibly an invalid value in the action parameter in a request to mrarticles.php or (2) a login QUERY_STRING to admin.php without any additional parameters which reveal the path in various error messages.


zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the (1) /photos/themes/default/ and (2) /photos/themes/testing/ URIs which reveals the path in an error message.


The HTTP service in EServ/3 3.25 allows remote attackers to obtain sensitive information via crafted HTTP requests containing dot space and slash characters which reveals the source code of script files.


videoPage.php in L0j1k tinyMuw 0.1.0 allows remote attackers to obtain sensitive information via a certain id parameter probably with an invalid value which reveals the path in an error message.


The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form which allows remote attackers to obtain sensitive information.


admin.php in Virtual War (VWar) 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwar_root parameter which reveals the path in an error message.


RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.


AngelineCMS

and

earlier

allow

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

for

adodb-access.inc.php

adodb-ado.inc.php

adodb-csv.inc.php

adodb-fbsql.inc.php

adodb-firebird.inc.php

adodb-ibase.inc.php

adodb-informix.inc.php

adodb-mssql.inc.php

adodb-mssqlpo.inc.php

adodb-mysql.inc.php

adodb-mysqlt.inc.php

and

adodb-odbc.inc.php

which

reveal

the

path

in

various

error

messages;

and

via

a

direct

request

for

the

lib/system/

directory

and

possibly

other

lib/

directories

which

provide

a

directory

listing

and

\architecture

view.\


Jemscripts DownloadControl 1.0 allows remote attackers to obtain sensitive information via an invalid dcid parameter to dc.php which leaks the pathname in an error message. NOTE: this was originally claimed to be SQL injection but it is probably resultant from another issue in functions.php.


Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) header.php (2) contact.php or (3) forum_extender.php which reveals the path in an error message.


The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site.


Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to (1) page_footer.php and (2) page_header.php which displays the path in an error message.


Unspecified vulnerability in WebSphere 5.1.1 (or any earlier cumulative fix) Common Configuration Mode + CommonArchive and J2EE Models might allow attackers to obtain sensitive information via the trace.


Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid (1) secondary (2) PageNum_Results (3) category or (4) keywords parameter in (a) Results.cfm; or an invalid (5) ProdID parameter in (b) Details.cfm; which reveal the path in various error messages. NOTE: the behavior for the category keywords and ProdID parameters might be resultant from SQL injection.


RT: Request Tracker 3.5.HEAD allows remote attackers to obtain sensitive information via the Rows parameter in Dist/Display.html which reveals the installation path in an error message.


phpBB 2.0.20 does not verify user-specified input variable types before being passed to type-dependent functions which allows remote attackers to obtain sensitive information as demonstrated by the (1) mode parameter to memberlist.php and the (2) highlight parameter to viewtopic.php that are used as an argument to the htmlspecialchars or urlencode functions which displays the installation path in the resulting error message.


Bitrix Site Manager 4.1.x stores updater.log under the web document root with insufficient access control which allows remote attackers to obtain sensitive information.


plug.php in Land Down Under (LDU) 802 and earlier allows remote attackers to obtain sensitive information via an invalid (1) month or (2) year parameter which reveals the path in an error message.


The Debian package of knowledgetree 2.0.7 creates environment.php with world-readable permissions which allows local users to obtain sensitive information such as the username and password for the KnowledgeTree database.


phpBB 2.0.20 does not properly verify user-specified input variables used as limits to SQL queries which allows remote attackers to obtain sensitive information via a negative LIMIT specification as demonstrated by the start parameter to memberlist.php which reveals the SQL query in the resulting error message.


iE Integrator 4.4.220114 when configured without a \bespoke error page\ in acm.ini allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory which results in an error message that displays the installation path web server name IP and port session cookie information and the IIS system username.


search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message possibly due to invalid parameters.


NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to (1) the profiles directory which leaks e-mail addresses contained in filenames of profiles and (2) the tmp directory which lists names of uploaded attachments.


U.N.U. Mailgust 1.9 allows remote attackers to obtain sensitive information via a direct request to index.php with method=showfullcsv which reveals the POP3 server configuration including account name and password.


The default configuration of Fluffington FLog 1.01 installs users.0.dat under the web document root with insufficient access control which might allow remote attackers to obtain sensitive information (login credentials) via a direct request. NOTE: It was later reported that 1.1.2 is also affected.


SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3 which reveals the path in an error message.


InfoVista PortalSE 2.0 Build 20087 on Solaris 8 allows remote attackers to obtain sensitive information by specifying a nonexistent server in the server field which reveals the path in an error message.


Uniden UIP1868P VoIP Telephone and Router has a default password of admin for the web-based configuration utility which allows remote attackers to obtain sensitive information on the device such as telephone numbers called and possibly connect to other hosts. NOTE: it is possible that this password was configured by a reseller not the original vendor; if so then this is not a vulnerability in the product.


admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to obtain sensitive information possibly the installation path of the application via unspecified \meta characters\ to the cpage parameter.


dm-crypt in Linux kernel 2.6.15 and earlier does not clear a structure before it is freed which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key.


CGIWrap before 3.10 allows remote attackers to obtain sensitive information via unknown attack vectors that cause errors in scripts that reveal system information.


ZyXel P2000W VoIP 802.11b Wireless Phone running firmware WV.00.02 allows remote attackers to obtain sensitive information such as MAC address and software version by directly accessing UDP port 9090.


The POP3 Server in ArGoSoft Mail Server Pro 1.8 allows remote attackers to obtain sensitive information via the _DUMP command which reveals the operating system registered user and registration code.


Linux kernel 2.6 before 2.6.15.5 allows local users to obtain sensitive information via a crafted XFS ftruncate call which may return stale data.


Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to obtain sensitive information (intranet IP addresses and enumerations of valid parameter values) via a direct request to hc which reveals the information in an error message or a cookie.


Microsoft PowerPoint 2000 in Office 2000 SP3 has an interaction with Internet Explorer that allows remote attackers to obtain sensitive information via a PowerPoint presentation that attempts to access objects in the Temporary Internet Files Folder (TIFF).


WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php (2) template-loader.php (3) rss-functions.php (4) locale.php (5) wp-db.php and (6) kses.php in the wp-includes/ directory; and (7) edit-form-advanced.php (8) admin-functions.php (9) edit-link-form.php (10) edit-page-form.php (11) admin-footer.php and (12) menu.php in the wp-admin directory; and possibly (13) list directory contents of the wp-includes directory. NOTE: the vars.php edit-form.php wp-settings.php and edit-form-comment.php vectors are already covered by CVE-2005-4463. The menu-header.php vector is already covered by CVE-2005-2110. Other vectors might be covered by CVE-2005-1688. NOTE: if the typical installation of WordPress does not list any site-specific files to wp-includes then vector 13 is not an exposure.


TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php (2) showpic.php or (3) tables.php which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails.


** DISPUTED ** dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory which reveal the path in an error message. NOTE: the vendor disputes this issue saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php.


The WYSIWYG rendering engine (\rich mail\ editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag which is executed when the user edits the e-mail.


WHMCompleteSolution (WHMCS) before 2.3 assigns incorrect permissions to \resellers\ which allows remote authenticated users to perform privileged actions or obtain sensitive information. NOTE: this report is based on a vendor bug report that identified \incorrect permissions.\ However the vendor did not label it a security issue and there was no statement regarding whether or not the permissions were actually more permissive than intended. If in fact the permissions were more restrictive than intended then this would be a functional problem but not a vulnerability.


Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 has multiple undocumented ports available which (1) might allow remote attackers to obtain sensitive information such as memory contents and internal operating-system data by directly accessing the VxWorks WDB remote debugging ONCRPC (aka wdbrpc) on UDP 17185 (2) reflect network data using echo (TCP 7) or (3) gain access without authentication using rlogin (TCP 513).


TinyPHPForum 3.6 and earlier stores the (1) users/USERNAME.hash and (2) users/USERNAME.email files under the web root with insufficient access control which allows remote attackers to list all registered users and possibly obtain other sensitive information.


** DISPUTED ** MySQL 5.0.18 allows local users with access to a VIEW to obtain sensitive information via the \SELECT * FROM information_schema.views;\ query which returns the query that created the VIEW. NOTE: this issue has been disputed by third parties saying that the availability of the schema is a normal and sometimes desired aspect of database access.


LightTPD 1.4.8 and earlier when the web root is on a case-insensitive filesystem allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for \.php\ names.


Note-A-Day Weblog 2.2 stores sensitive data under the web document root with insufficient access control which allows remote attackers to obtain sensitive information via a direct request to archive/.phpass-admin which contains encrypted passwords.


Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form which displays the installation path in a MySQL error message.


The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to obtain sensitive information via an invalid feed parameter which reveals the path in an error message.


Scry Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid p parameter which reveals the path in an error message.


sql_parse.cc in MySQL 4.0.x up to 4.0.26 4.1.x up to 4.1.18 and 5.0.x up to 5.0.20 allows remote attackers to obtain sensitive information via a COM_TABLE_DUMP request with an incorrect packet length which includes portions of memory in an error message.


polls.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to obtain sensitive information via a vote action with an \option=null\ parameter value which reveals the path in an error message.


The Linux kernel before 2.6.16.9 and the FreeBSD kernel when running on AMD64 and other 7th and 8th generation AuthenticAMD processors only save/restore the FOP FIP and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending which allows one process to determine portions of the state of floating point instructions of other processes which can be leveraged to obtain sensitive information such as cryptographic keys. NOTE: this is the documented behavior of AMD64 processors but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.


LucidCMS 2.0.0 RC4 allows remote attackers to obtain sensitive information via a direct request to /lucid_phplib/translator.php which reveals the path in an error message.


agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AG_ID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


DbbS 2.0-alpha and earlier allows remote attackers to obtain sensitive information via an invalid (1) fcategoryid parameter to topics.php or (2) unavariabile (3) GLOBALS or (4) _SERVER parameters to script.php. NOTE: this information leak might be resultant from a global variable overwrite issue.


Hosting Controller 6.1 stores forum/db/forum.mdb under the web document root with insufficient access control which allows remote attackers to obtain sensitive information such as user name and password credentials. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Unspecified vulnerability in mod_templatechooser in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via an unspecified attack vector that reveals the path.


Noah's Classifieds 1.3 and earlier allows remote attackers to obtain sensitive information via an invalid list parameter in the showdetails method to index.php which reveals the path in an error message.


Unspecified vulnerability in Sybase Pylon Anywhere groupware synchronization server before 7.0 allows local users to obtain sensitive information such as email and PIM data of another user via unknown attack vectors.


Craig

Knudsen

WebCalendar

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

to

includes/index.php

groups.php

nonusers.php

includes/settings.php

includes/init.php

includes/settings.php.orig

or

which

reveal

the

path

in

various

error

messages.


LetterMerger 1.2 stores user information in Access database files with insecure permissions which allows local users to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php which lists the database table_prefix.


TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control which allows remote attackers to download the admin password file and obtain password hashes via a direct request to admin/passwd.


** DISPUTED ** Kwik-Pay Payroll 4.2.20 and possibly other versions stores the KwikPay.mdb database file with insecure permissions which allows local users to obtain sensitive information such as employment and payment data. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the vendor has disputed this vulnerability stating that \The kwikpay.mdb file supplied with kwikpay is a template for the database structure of user databases created by kwikpay and to store a demonstration payroll. It does not contain any sensitive user information. When a user payroll database is opened the encryption of the database is checked and if the database is not encrypted the user is prompted to encrypt the database but the choice is the customers.\


SGI ProPack 3 SP6 kernel displays the frame buffer contents of the last session after a reboot which might allow local users to obtain sensitive information.


The backup configuration option in NETGEAR WGT624 Wireless Firewall Router stores sensitive information in cleartext which allows remote attackers to obtain passwords and gain privileges.


Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a \*/*\ in the msg parameter to index.php which reveals usernames and passwords in a MySQL error message possibly due to a forced SQL error or SQL injection.


Webplus (aka talentsoft) Web+Shop 5.3.6 when Redirect URL for \Script Not Found\ Error is not configured allows remote attackers to obtain sensitive information via a quote (') or possibly other invalid value in the storeid parameter in store.wml in webplus.exe which reveals the path in a \Script Not Found\ error message.


Annuaire (Directory) 1.0 allows remote attackers to obtain sensitive information via a direct request to include/lang-en.php which reveals the full installation path.


The HTML rendering engine in Mozilla Thunderbird 1.5 when \Block loading of remote images in mail messages\ is enabled does not properly block external images from inline HTML attachments which could allow remote attackers to obtain sensitive information such as application version or IP address when the user reads the email and the external image is accessed.


feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via a \/\ (slash) in the feed parameter to index.php which reveals the path in an error message.


fusionZONE couponZONE 4.2 allows remote attackers to obtain the full path of the web server and other sensitive information via invalid values as demonstrated using manipulations associated with SQL.


index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter which reveals the path in an error message.


Renasoft NetJetServer 2.5.3.939 and possibly earlier uses insecure permissions for Global.asa which allows remote attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; details are obtained from third party sources.


Jeroen

Vennegoor

JevonCMS

possibly

pre

alpha

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

for

php/main/phplib

files

and

and

which

reveals

the

path

in

various

error

messages.


index.php in Wheatblog (wB) allows remote attackers to obtain sensitive information via certain values of the postPtr and next parameters which reveals the path in an error message.


The keystore file in Unicore Client before 5.6 build 5 when running on Unix systems has insecure default permissions which allows local users to obtain sensitive information.


list.php in DigiOz Guestbook before 1.7.1 allows remote attackers to obtain sensitive information via a non-numeric page parameter which displays the installation path in the resulting error message.


Verity

Ultraseek

before

allows

remote

attackers

to

obtain

sensitive

information

via

direct

requests

with

a

terminated

url

parameter

to

help/urlstatusgo.html;

or

missing

parameters

to

help/header.html

help/footer.html

spell.html

coreforma.html

daterange.html

hits.html

hitsnavbottom.html

indexform.html

indexforma.html

languages.html

nohits.html

query.html

quicklinks.html

relatedtopics.html

signin.html

subtopics.html

thesaurus.html

topics.html

hitspagebar.html

highlight/highlight.html

and

highlight/topnav.html

which

leaks

the

installation

path

in

the

resulting

error

message.


QuickTime for Java on Mac OS X 10.4 through 10.4.8 when used with Quartz Composer allows remote attackers to obtain sensitive information (screen images) via a Java applet that accesses images that are being rendered by other embedded QuickTime objects.


Groupee UBB.threads 6.5.1.1 allows remote attackers to obtain sensitive information via a direct request for cron/php/subscriptions.php which reveals the path in an error message.


Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for (1) link_navi.php or (2) spotlight.php which reveals the path in various error messages. NOTE: the information.php language.php list_docs.php popular_prod.php sale.php check_sum.php and cat_navi.php vectors are already covered by CVE-2005-0607.


Google Mini 4.4.102.M.36 and earlier allows remote attackers to obtain sensitive information via a direct request for /search with an invalid client parameter which reveals the path in an error message.


Tikiwiki

allows

remote

attackers

to

obtain

sensitive

information

(MySQL

username

and

password)

via

an

empty

parameter

in

tiki-listpages.php

tiki-lastchanges.php

messu-archive.php

messu-mailbox.php

messu-sent.php

tiki-forums.php

tiki-friends.php

tiki-shoutbox.php

tiki-usermenu.php

and

which

reveal

the

information

in

certain

database

error

messages.


phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control which allows remote attackers to obtain sensitive information via direct requests for certain files.


Unspecified vulnerability in an ActiveX control used in Symantec Automated Support Assistant as used in Norton AntiVirus Internet Security and System Works 2005 and 2006 allows user-assisted remote attackers to obtain sensitive information via unspecified vectors.


rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a display_get_requesters operation which allows remote attackers to bypass the GUI login and obtain sensitive information (ticket data) via a direct request.


Unspecified vulnerability in Maerys Archive (Maarch) before 2.0.1 allows remote authenticated users to obtain sensitive information (document contents) via unspecified attack vectors related to \grants.\


tools/tellhim.php in PHP-Wyana allows remote attackers to obtain sensitive information via an invalid lang parameter which reveals the path in an error message.


XLineSoft PHPRunner 3.1 stores the (1) database server name (2) database names (3) usernames and (4) passwords in plaintext in %WINDIR%\\PHPRunner.ini which allows local users to obtain sensitive information by reading the file.


Patrick Michaelis Wili-CMS allows remote attackers to obtain sensitive information via a direct request for (1) thumbnail.php (2) functions/admin/all.php (3) functions/admin/init_session.php (4) functions/all.php and (5) certain files in example-view/admin_templates/ which reveals the path in various error messages.


Bluview Blue Magic Board (BMB) (aka BMForum) 5.5 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php (2) header.php (3) db_mysql_error.php (4) langlist.php (5) sendmail.php or (6) style.php which reveals the path in various error messages.


AlphaMail before 1.0.16 allows local users to obtain sensitive information via the logging functionality which displays unencrypted passwords in an error message. NOTE: some details are obtained from third party information.


WordPress

through

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

for

akismet.php

archive.php

archives.php

attachment.php

blogger.php

comments.php

comments-popup.php

dotclear.php

footer.php

functions.php

header.php

hello.php

links.php

livejournal.php

mt.php

page.php

rss.php

searchform.php

search.php

sidebar.php

single.php

textpattern.php

upgrade-functions.php

upgrade-schema.php

or

wp-db-backup.php

which

reveal

the

path

in

various

error

messages.

NOTE:

another

researcher

has

disputed

the

details

of

this

report

stating

that

version

does

not

exist.

NOTE:

the

admin-footer.php

admin-functions.php

default-filters.php

edit-form-advanced.php

edit-link-form.php

edit-page-form.php

kses.php

locale.php

rss-functions.php

template-loader.php

and

wp-db.php

vectors

are

already

covered

by

The

edit-form-comment.php

vars.php

and

wp-settings.php

vectors

are

already

covered

by

The

menu-header.php

vector

is

already

covered

by


The ArrowPoint cookie functionality for Cisco 11000 series Content Service Switches specifies an internal IP address if the administrator does not specify a string option which allows remote attackers to obtain sensitive information.


lib/setup.php in Moodle before 1.6.2 sets the error reporting level to 7 to display E_WARNING messages to users even if debugging is disabled which might allow remote authenticated users to obtain sensitive information by triggering the messages.


Lyris ListManager 8.95 allows remote authenticated users to obtain sensitive information by attempting to add a user with a ' (single quote) character in the name which reveals the details of the underlying SQL query possibly because of a forced SQL error or SQL injection.


The config method in Henrik Storner Hobbit monitor before 4.1.2p2 permits access to files outside of the intended configuration directory which allows remote attackers to obtain sensitive information via requests to the hobbitd daemon on port 1984/tcp.


Kellan Elliott-McCrea MagpieRSS allows remote attackers to obtain sensitive information via a direct request for (1) rss_fetch.inc.php or (2) rss_parse.inc.php which reveals the path in various error messages.


Sun Secure Global Desktop (SSGD aka Tarantella) before 4.3 allows remote attackers to obtain sensitive information including hostnames versions and settings details via unspecified vectors possibly involving (1) taarchives.cgi (2) ttaAuthentication.jsp (3) ttalicense.cgi (4) ttawlogin.cgi (5) ttawebtop.cgi (6) ttaabout.cgi or (7) test-cgi. NOTE: This information is based upon a vague initial disclosure. Details will be updated as they become available.


and

Client

Support

Center

in

Cerberus

Helpdesk

Build

and

possibly

earlier

allows

remote

attackers

to

bypass

security

restrictions

and

obtain

sensitive

information

via

the

ticket

parameter.

NOTE:

the

provenance

of

this

information

is

unknown;

the

details

are

obtained

from

third

party

information.


MyBB (aka MyBulletinBoard) allows remote attackers to obtain sensitive information via a direct request for inc/plugins/hello.php which reveals the path in an error message.


login/forgot_password.php in Moodle before 1.6.2 allows remote attackers to obtain sensitive information (e-mail addresses and Moodle account names) via a find action.


DokuWiki before 2006-03-09c enables the debug feature by default which allows remote attackers to obtain sensitive information by calling doku.php with the X-DOKUWIKI-DO HTTP header set to \debug\.


IBM WebSphere Application Server (WAS) before 6.0.2.13 allows context-dependent attackers to obtain sensitive information via unspecified vectors related to \JSP source code exposure\ (PK23475) which occurs when ibm-web-ext.xmi sets fileServingEnabled to true or ExtendedDocumentRoot is used to place a JSP outside a WAR.file; (3) the First Failure Data Capture (ffdc) log file (PK24834); and (4) traces (PK25568) a different issue than CVE-2006-4137.


Jupiter

CMS

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

for

includes/functions.php

modules/register.php

modules/poll.php

modules/panel.php

modules/pm.php

modules/news.php

modules/users.php

modules/misc.php

modules/masspm.php

modules/mass-email.php

modules/main-nav.php

modules/login.php

modules/layout.php

modules/hq.php

modules/forum.php

modules/forum-admin.php

modules/events.php

modules/emoticons.php

modules/download.php

modules/blocks.php

modules/ban.php

modules/badwords.php

modules/ads.php

or

modules/admin.php

which

reveals

the

installation

path

in

various

error

messages.

NOTE:

The

modules/online.php

vector

is

already

covered

by


The Remote UI in Canon imageRUNNER includes usernames and passwords when exporting an address book which allows context-dependent attackers to obtain sensitive information.


Globus Toolkit 3.2.x 4.0.x and 4.1.0 before 20060815 allow local users to obtain sensitive information (proxy certificates) and overwrite arbitrary files via a symlink attack on temporary files in the /tmp directory as demonstrated by files created by (1) myproxy-admin-adduser (2) grid-ca-sign and (3) grid-security-config.


OSU 3.11alpha and 3.10a allows remote attackers to obtain sensitive information via a URL to a non-existent file which displays the web root path in the resulting error message.


David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to obtain sensitive information via a direct request for (1) footer.php (2) template.php or (3) lastvisit.php which reveals the installation path in various error messages.


Grayscale

BandSite

CMS

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

for

certain

files

in

the

includes/content

directory

and

adminpanel/configform.php;

and

files

in

adminpanel/includes/

including

mailinglist/disphtmltbl.php

mailinglist/dispxls.php

mailinglist/sendshows.php

and

which

reveals

the

path

in

various

error

messages.


Unspecified vulnerability in Cybozu Office 6.5 Build 1.2 for Windows allows remote attackers to obtain sensitive information including users and groups via unspecified vectors.


index.php in myWebland myBloggie 2.1.4 and earlier allows remote attackers to obtain sensitive information via a query that only specifies the viewdate mode which reveals the table prefix in a SQL error message.


Abidia (1) O-Anywhere and (2) Abidia Wireless transmit authentication credentials in cleartext which allows remote attackers to obtain sensitive information by sniffing.


AuditWizard 6.3.2 when using \Remote Audit \ logs the administrator password in plaintext to LaytonCmdSvc.log which allows local users to obtain sensitive information by reading the file.


Walter Beschmout PhpQuiz allows remote attackers to obtain sensitive information via a direct request to cfgphpquiz/install.php and other unspecified vectors.


Jetbox CMS allows remote attackers to obtain sensitive information via a direct request for certain files which reveal the path in an error message.


Shape Services IM+ Mobile Instant Messenger for Pocket PC 3.10 stores usernames and passwords in plaintext in %PROGRAMFILES%\\IMPlus\\implus.cfg which allows local users to obtain sensitive information by reading the file.


SmartLine DeviceLock before 5.73 Build 305 does not properly enforce access control lists (ACL) in raw mode which allows local users to bypass NTFS controls and obtain sensitive information.


xbiff2 1.9 creates $HOME/.xbiff2rc in a user's home directory with insecure file permissions which allows local users to obtain sensitive information such as login credentials. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


IBM Director before 5.10 allows remote attackers to obtain sensitive information from HTTP headers via HTTP TRACE.


PDAapps

Verichat

for

Pocket

PC

stores

usernames

and

passwords

in

plaintext

in

the

Windows

Mobile

registry

which

allows

local

users

to

obtain

sensitive

information

via

keys

under


TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db which allows local users to obtain sensitive information by decoding the log file.


export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents which allows remote attackers to obtain sensitive information.


OSU 3.11alpha and 3.10a allows remote attackers to obtain sensitive information via a URL containing an * (asterisk) wildcard which displays all matching file and directory information.


course/jumpto.php in Moodle before 1.6.2 does not validate the session key (sesskey) before providing content from arbitrary local URIs which allows remote attackers to obtain sensitive information via the jump parameter.


The

Date

Library

in

John

Lim

ADOdb

Library

for

PHP

allows

remote

attackers

to

obtain

sensitive

information

via

a

direct

request

for

server.php

adodb-errorpear.inc.php

adodb-iterator.inc.php

adodb-pear.inc.php

adodb-perf.inc.php

adodb-xmlschema.inc.php

and

adodb.inc.php;

files

in

datadict

including

datadict-access.inc.php

datadict-generic.inc.php

datadict-ibase.inc.php

datadict-informix.inc.php

datadict-mssql.inc.php

datadict-mysql.inc.php

datadict-postgres.inc.php

and

datadict-sybase.inc.php;

files

in

drivers/

including

adodb-access.inc.php

adodb-ado.inc.php

adodb-csv.inc.php

adodb-fbsql.inc.php

adodb-firebird.inc.php

adodb-ibase.inc.php

adodb-informix.inc.php

adodb-mssql.inc.php

adodb-mssqlpo.inc.php

adodb-mysql.inc.php

adodb-mysqli.inc.php

adodb-mysqlt.inc.php

adodb-odbc.inc.php

adodb-oracle.inc.php

adodb-proxy.inc.php

adodb-sapdb.inc.php

adodb-sqlanywhere.inc.php

adodb-sqlite.inc.php

adodb-sybase.inc.php

adodb-vfp.inc.php;

file

in

perf/

including

perf-informix.inc.php

perf-mssql.inc.php

perf-mysql.inc.php

perf-postgres.inc.php;

tests/

files

benchmark.php

client.php

test-datadict.php

test-perf.php

test-pgblob.php

test-xmlschema.php

test.php

testcache.php

testdatabases.inc.php

testgenid.php

testmssql.php

testpaging.php

testpear.php

testsessions.php

time.php

or

tmssql.php

which

reveals

the

path

in

various

error

messages.


DUware DUpoll 3.0 and 3.1 stores _private/Dupoll.mdb under the web document root with insufficient access control which allows remote attackers to obtain sensitive information such as usernames and passwords.


Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt.


Monkey Boards 0.3.5 allows remote attackers to obtain sensitive information via direct requests to (1) include/admin_auth.inc.php and (2) include/engine/class.compiler.php which reveals the full path in an error message. NOTE: this issue is only an exposure if the administrator has changed the default script path.


The SNMP implementation in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000 13.x before 13.050.03.000 and 14.x before 14.050.03.000 does not generate authentication failure traps which allows remote attackers to more easily gain system access and obtain sensitive information via a brute force attack.


PostNuke 0.7.5.0 and certain minor versions allows remote attackers to obtain sensitive information via a non-numeric value of the stop parameter which reveals the path in an error message.


tiki-wiki_rss.php in Tikiwiki 1.9.5 1.9.2 and possibly other versions allows remote attackers to obtain sensitive information (MySQL username and password) via an invalid (large or negative) ver parameter which leaks the information in an error message.


FreeStyle Wiki (fswiki) 3.6.2 and earlier stores sensitive information under the web root with insufficient access control which allows remote attackers to obtain passwords via a direct request for config/user.dat.


HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via playinfo mode with certain values of the player and playerdatalastName parameters which reveals the path in an error message.


Unspecified vulnerability in ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote attackers to obtain sensitive information including passwords via unspecified vectors.


Palm Desktop 4.1.4 and earlier stores user data with weak permissions under the application directory which allows local users to obtain sensitive information (address books calendar files and todo lists of other users) via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


The AutoFill feature in Apple Safari 2.0.4 does not properly verify that all automatically populated form fields are visible to the user which allows remote attackers to obtain sensitive information such as usernames and passwords via input fields of zero width a variant of CVE-2006-6077.


Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History) which allows remote attackers to obtain sensitive information by reading the Change column as demonstrated by the Change column of a custom field.


Xerox WorkCentre and WorkCentre Pro before 12.050.03.000 13.x before 13.050.03.000 and 14.x before 14.050.03.000 allows remote attackers to download the audit log and obtain potentially sensitive information via unspecified vectors.


form.php in GenesisTrader 1.0 allows remote attackers to read source code for arbitrary files and obtain sensitive information via the (1) do and (2) chem parameters with a \modfich\ floap parameter.


bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to (1) blogs/list_blogs.php (2) fisheye/index.php (3) wiki/orphan_pages.php or (4) wiki/list_pages.php which forces a SQL error. NOTE: the fisheye/list_galleries.php vector is already covered by CVE-2005-4380.


Unspecified vulnerability in ptrace in NetBSD-current before 20061027 NetBSD 3.0 and 3.0.1 before 20061027 and NetBSD 2.x before 20061119 allows local users to read kernel memory and obtain sensitive information via certain manipulations of a PT_LWPINFO request which leads to a memory leak and information leak.


Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS (b) CFM (c) CFML or (d) CFC file which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm without a host which can reveal the server's internal IP address in an HREF tag.


AlstraSoft Web Host Directory allows remote attackers to obtain sensitive information by requesting any invalid URI which reveals the path in an error message a different vulnerability than CVE-2006-2617.


The file manager in AlternC 0.9.5 and earlier when warnings are enabled in PHP allows remote attackers to obtain sensitive information via certain folder names such as ones composed of JavaScript code which reveal the path in a warning message.


P-News 1.16 and 1.17 store sensitive information under the web root with insufficient access control which allows remote attackers to obtain the administrative account name and password hash via a direct request for db/user.dat.


Web services in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000 13.x before 13.060.17.000 and 14.x before 14.060.17.000 do not require HTTPS which allows remote attackers to obtain sensitive information by sniffing the unencrypted HTTP traffic.