deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-3575
Published: 2011-09-19
Description: Stack-based buffer overflow in the NSFComputeEvaluateExt function in Nnotes.dll in IBM Lotus Domino 8.5.2 allows remote authenticated users to execute arbitrary code via a long tHPRAgentName parameter in an fmHttpPostRequest OpenForm action to WebAdmin.nsf.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://www.research.reversingcode.com/exploits/IBMLotusDomino_StackOverflowPoC; http://www.research.reversingcode.com/index.php/advisories/73-ibm-ssd-1012211; http://www.securityfocus.com/bid/49705
CVE: CVE-2011-3576
Published: 2011-09-19
Description: Cross-site scripting (XSS) vulnerability in IBM Lotus Domino 8.5.2 allows remote attackers to inject arbitrary web script or HTML via the PanelIcon parameter in an fmpgPanelHeader ReadForm action to WebAdmin.nsf.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.research.reversingcode.com/index.php/advisories/73-ibm-ssd-1012211; http://www.securityfocus.com/bid/49701; http://www.research.reversingcode.com/index.php/advisories/73-ibm-ssd-1012211
CVE: CVE-2011-2925
Published: 2011-09-20
Description: Cumin in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0 records broker authentication credentials in a log file, which allows local users to bypass authentication and perform unauthorized actions on jobs and message queues via a direct connection to the broker.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/75217; http://secunia.com/advisories/45887; http://secunia.com/advisories/45928
CVE: CVE-2011-3348
Published: 2011-09-20
Description: The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: http://community.jboss.org/message/625307; http://httpd.apache.org/security/vulnerabilities_22.html#2.2.21; http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
CVE: CVE-2011-1509
Published: 2011-09-20
Description: The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://securityreason.com/securityalert/8385; http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp; http://www.securityfocus.com/archive/1/519652/100/0/threaded
CVE: CVE-2011-1510
Published: 2011-09-20
Description: Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8385; http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp; http://www.securityfocus.com/archive/1/519652/100/0/threaded
CVE: CVE-2011-1911
Published: 2011-09-20
Description: JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.csirtcv.gva.es/es/alertas/vulnerabilidad-en-jasperserver.html; http://www.csirtcv.gva.es/sites/all/files/images/content/%5BCSIRT-cv%5D%20JasperServer%203.7.0%20CE%20CSRF%20Advisory.pdf; http://www.kb.cert.org/vuls/id/519588
CVE: CVE-2011-2672
Published: 2011-09-20
Description: Cross-site scripting (XSS) vulnerability in SemanticScuttle before 0.98 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN28973089/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000074; http://osvdb.org/75585
CVE: CVE-2011-3360
Published: 2011-09-20
Description: Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/75347; http://www.debian.org/security/2011/dsa-2324; http://www.mandriva.com/security/advisories?name=MDVSA-2011:138
CVE: CVE-2011-3482
Published: 2011-09-20
Description: The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.2 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=38430; http://www.mandriva.com/security/advisories?name=MDVSA-2011:138; http://www.openwall.com/lists/oss-security/2011/09/13/1
CVE: CVE-2011-3483
Published: 2011-09-20
Description: Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an invalid root tvbuff, related to a "buffer exception handling vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.mandriva.com/security/advisories?name=MDVSA-2011:138; http://www.openwall.com/lists/oss-security/2011/09/13/1; http://www.openwall.com/lists/oss-security/2011/09/14/10
CVE: CVE-2011-3484
Published: 2011-09-20
Description: The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service (loop and application crash) via a malformed packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=38213; http://www.mandriva.com/security/advisories?name=MDVSA-2011:138; http://www.openwall.com/lists/oss-security/2011/09/13/1
CVE: CVE-2011-3577
Published: 2011-09-20
Description: IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.3 does not properly implement Activity Token authentication for Web Services, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/45999; http://www.ibm.com/support/docview.wss?uid=swg1JR40420; http://www.ibm.com/support/docview.wss?uid=swg24030908
CVE: CVE-2011-2412
Published: 2011-09-21
Description: Unspecified vulnerability in HP Business Service Automation (BSA) Essentials 2.01 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4951&w=2; http://securityreason.com/securityalert/8390; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4951&w=2
CVE: CVE-2011-2937
Published: 2011-09-21
Description: Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html; http://sourceforge.net/news/?group_id=139281&id=302769; http://support.apple.com/kb/HT5130
CVE: CVE-2011-2938
Published: 2011-09-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the project_id parameter to search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html; http://packetstormsecurity.org/files/104149; http://secunia.com/advisories/51199
CVE: CVE-2011-3290
Published: 2011-09-21
Description: Cisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which allows remote attackers to modify settings or perform unspecified other administrative actions via unknown vectors, aka Bug ID CSCts59135.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/46061; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95105.shtml; http://www.securityfocus.com/bid/49703
CVE: CVE-2011-3356
Published: 2011-09-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO, as demonstrated by the PATH_INFO to (1) manage_config_email_page.php, (2) manage_config_workflow_page.php, or (3) bugs/plugin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297; http://lists.debian.org/debian-security-tracker/2011/09/msg00012.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html
CVE: CVE-2011-3357
Published: 2011-09-21
Description: Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter, related to bug_actiongroup_page.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297; http://lists.debian.org/debian-security-tracker/2011/09/msg00012.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html
CVE: CVE-2011-3358
Published: 2011-09-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php, related to use of the Projax library.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297; http://lists.debian.org/debian-security-tracker/2011/09/msg00012.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html
CVE: CVE-2011-3578
Published: 2011-09-21
Description: Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bug_actiongroup_page.php, a different vulnerability than CVE-2011-3357.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297; http://lists.debian.org/debian-security-tracker/2011/09/msg00012.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html
CVE: CVE-2011-2426
Published: 2011-09-22
Description: Stack-based buffer overflow in the ActionScript Virtual Machine (AVM) component in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00025.html; http://secunia.com/advisories/48308; http://www.adobe.com/support/security/bulletins/apsb11-26.html
CVE: CVE-2011-2427
Published: 2011-09-22
Description: Stack-based buffer overflow in the ActionScript Virtual Machine (AVM) component in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00025.html; http://secunia.com/advisories/48308; http://www.adobe.com/support/security/bulletins/apsb11-26.html
CVE: CVE-2011-2428
Published: 2011-09-22
Description: Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows attackers to execute arbitrary code or cause a denial of service (browser crash) via unspecified vectors, related to a "logic error issue."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00025.html; http://secunia.com/advisories/48308; http://www.adobe.com/support/security/bulletins/apsb11-26.html
CVE: CVE-2011-2429
Published: 2011-09-22
Description: Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, related to a "security control bypass."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00025.html; http://secunia.com/advisories/48308; http://www.adobe.com/support/security/bulletins/apsb11-26.html
CVE: CVE-2011-2430
Published: 2011-09-22
Description: Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to execute arbitrary code via crafted streaming media, related to a "logic error vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00025.html; http://secunia.com/advisories/48308; http://www.adobe.com/support/security/bulletins/apsb11-26.html
CVE: CVE-2011-2444
Published: 2011-09-22
Description: Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site scripting issue," as exploited in the wild in September 2011.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2011/09/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00025.html; http://secunia.com/advisories/48308
CVE: CVE-2011-1913
Published: 2011-09-22
Description: SQL injection vulnerability in the login form in the web interface in Mercator SENTINEL 2.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://cert.netpeas.org/2011/06/cert-nps2011005-vulnerabilite-potentielle-dans-la-solution-de-gestion-de-la-securite-operationnelle-des-compagnies-aeriennes-%C2%AB-sentinel-safety-information-management-system-%C2%BB/; http://cert.netpeas.org/2011/06/cert-nps2011005-vulnerabilite-potentielle-dans-la-solution-de-gestion-de-la-securite-operationnelle-des-compagnies-aeriennes-suite/; http://secunia.com/advisories/46014
CVE: CVE-2011-3207
Published: 2011-09-22
Description: crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://cvs.openssl.org/chngview?cn=21349; http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065712.html
CVE: CVE-2011-3210
Published: 2011-09-22
Description: The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cvs.openssl.org/chngview?cn=21337; http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1816&w=2
CVE: CVE-2011-2543
Published: 2011-09-23
Description: Buffer overflow in the cuil component in Cisco Telepresence System Integrator C Series 4.x before TC4.2.0 allows remote authenticated users to cause a denial of service (endpoint reboot or process crash) or possibly execute arbitrary code via a long location parameter to the getxml program, aka Bug ID CSCtq46496.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/46057; http://secunia.com/advisories/46109; http://securityreason.com/securityalert/8393
CVE: CVE-2011-2544
Published: 2011-09-23
Description: Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a crafted Call ID, as demonstrated by resultant cross-site request forgery (CSRF) attacks that change passwords or cause a denial of service, aka Bug ID CSCtq46488.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/46057; http://secunia.com/advisories/46109; http://securityreason.com/securityalert/8393
CVE: CVE-2011-2766
Published: 2011-09-23
Description: The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479; http://www.debian.org/security/2011/dsa-2327; http://www.mandriva.com/security/advisories?name=MDVSA-2012:001
CVE: CVE-2011-3695
Published: 2011-09-23
Description: 111WebCalendar 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by footer.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/111WebCalendar-1.2.3; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3696
Published: 2011-09-23
Description: 60cycleCMS 2.5.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by post.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/60cycleCMS.2.5.2; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3697
Published: 2011-09-23
Description: Achievo 1.4.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/graph/jpgraph/jpgraph_radar.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/achievo-1.4.5; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3698
Published: 2011-09-23
Description: AdaptCMS 2.0.2 Beta allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/poll_vote.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/AdaptCMS_2.0.2_Beta; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3699
Published: 2011-09-23
Description: John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/test-active-record.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/adodb; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3700
Published: 2011-09-23
Description: Advanced Electron Forum (AEF) 1.0.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by languages/english/deletetopic_lang.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/aef-1.0.8; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3701
Published: 2011-09-23
Description: AlegroCart 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by common.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/AlegroCart_1.2.3; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3702
Published: 2011-09-23
Description: Ananta Gazelle 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/template.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/Ananta_Gazelle1.0; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3703
Published: 2011-09-23
Description: AneCMS 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/menu/index.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/anecms-1.0; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3704
Published: 2011-09-23
Description: appRain 0.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by cron.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/appRain-d-0.1.0; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3705
Published: 2011-09-23
Description: Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/Arctic-Fox-CMS-v0.9.4; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3706
Published: 2011-09-23
Description: ATutor 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by users/tool_settings.inc.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/ATutor-2.0; http://www.openwall.com/lists/oss-security/2011/06/27/6