CWE-264 (page 47)
Page 47 of 55 — CVEs classified under CWE-264, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2009-0436 | | 2009-02-10 | The (1) mod_ibm_ssl and (2) mod_cgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server (WAS)… | |
CVE-2009-0469 | | 2009-02-10 | Unspecified vulnerability in futomi's CGI Cafe Fulltext search CGI 1.1.2 allows remote attackers to gain administrative privileges via unknown vectors. | |
CVE-2009-0498 | | 2009-02-10 | Virtual GuestBook (vgbook) 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the… | |
CVE-2008-6098 | | 2009-02-09 | Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and other versions after 2.17.4 allows remote authenticated users to byp… | |
CVE-2009-0477 | | 2009-02-08 | Unspecified vulnerability in the process (aka proc) filesystem in Sun OpenSolaris snv_85 through snv_100 allows local users to gain privileges via vectors rela… | |
CVE-2008-6065 | | 2009-02-05 | Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTORY stateme… | |
CVE-2009-0062 | | 2009-02-05 | Unspecified vulnerability in the Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated W… | |
CVE-2008-6059 | | 2009-02-05 | xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP respo… | |
CVE-2009-0419 | | 2009-02-04 | Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly restrict access from… | |
CVE-2009-0357 | | 2009-02-04 | Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response… | |
CVE-2009-0355 | | 2009-02-04 | components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, w… | |
CVE-2008-6057 | | 2009-02-04 | Doug Luxem Liberum Help Desk 0.97.3 stores db/helpdesk2000.mdb under the web root with insufficient access control, which allows remote attackers to obtain pas… | |
CVE-2008-6055 | | 2009-02-04 | PreProjects Pre Classified Listings stores pclasp.mdb under the web root with insufficient access control, which allows remote attackers to obtain passwords vi… | |
CVE-2008-6054 | | 2009-02-04 | PreProjects Pre Courier and Cargo Business stores dbcourior.mdb under the web root with insufficient access control, which allows remote attackers to obtain pa… | |
CVE-2008-6053 | | 2009-02-04 | PreProjects Pre Resume Submitter stores onlineresume.mdb under the web root with insufficient access control, which allows remote attackers to obtain passwords… | |
CVE-2008-6052 | | 2009-02-04 | PreProjects Pre E-Learning Portal stores db_elearning.mdb under the web root with insufficient access control, which allows remote attackers to obtain password… | |
CVE-2008-6051 | | 2009-02-04 | MetaCart Free stores metacart.mdb under the web root with insufficient access control, which allows remote attackers to obtain usernames and passwords via a di… | |
CVE-2009-0411 | | 2009-02-03 | Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows… | |
CVE-2009-0399 | | 2009-02-03 | Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php. NOTE: this is only a vulnerability… | |
CVE-2009-0383 | | 2009-02-02 | delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request. | |
CVE-2009-0382 | | 2009-02-02 | Unspecified vulnerability in Internationalization (i18n) Translation 5.x before 5.x-2.5, a module for Drupal, allows remote attackers with "translate node" per… | |
CVE-2008-6008 | | 2009-01-30 | hyBook Guestbook Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database… | |
CVE-2009-0345 | | 2009-01-29 | Unspecified vulnerability in the Embedded Lights Out Manager (ELOM) on the Sun Fire X2100 M2 and X2200 M2 x86 platforms before SP/BMC firmware 3.20 allows remo… | |
CVE-2009-0344 | | 2009-01-29 | Unspecified vulnerability in the Embedded Lights Out Manager (ELOM) on the Sun Fire X2100 M2 and X2200 M2 x86 platforms before SP/BMC firmware 3.20 allows remo… | |
CVE-2009-0343 | | 2009-01-29 | Niels Provos Systrace 1.6f and earlier on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 32-bit syscall with a… | |
CVE-2009-0342 | | 2009-01-29 | Niels Provos Systrace before 1.6f on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 64-bit syscall with a sysc… | |
CVE-2009-0336 | | 2009-01-29 | Katy Whitton BlogIt! stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database f… | |
CVE-2009-0328 | | 2009-01-29 | ROBS-PROJECTS Digital Sales IPN (aka DS-IPN.NET or DS-IPN Paypal Shop) stores sensitive information under the web root with insufficient access control, which… | |
CVE-2008-6001 | | 2009-01-28 | index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpusuario cookie composed of an initial sy… | |
CVE-2008-5981 | | 2009-01-27 | PacPoll 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct… | |
CVE-2008-5980 | | 2009-01-27 | Ocean12 Mailing List Manager Gold stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a databa… | |
CVE-2008-5956 | | 2009-01-23 | Wbstreet (aka PHPSTREET Webboard) 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain… | |
CVE-2008-5951 | | 2009-01-23 | ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database… | |
CVE-2009-0250 | | 2009-01-22 | Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the file cont… | |
CVE-2009-0249 | | 2009-01-22 | Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database cont… | |
CVE-2008-5935 | | 2009-01-21 | Facto stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing… | |
CVE-2008-5932 | | 2009-01-21 | CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the databas… | |
CVE-2008-5931 | | 2009-01-21 | The Net Guys ASPired2Blog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the datab… | |
CVE-2008-5929 | | 2009-01-21 | VP-ASP Shopping Cart 6.50 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the datab… | |
CVE-2008-5925 | | 2009-01-21 | ASP-DEv XM Events Diary stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the databas… | |
CVE-2009-0240 | | 2009-01-21 | listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted pro… | |
CVE-2008-5916 | | 2009-01-21 | gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4… | |
CVE-2009-0180 | | 2009-01-20 | Certain Fedora build scripts for nfs-utils before 1.1.2-9.fc9 on Fedora 9, and before 1.1.4-6.fc10 on Fedora 10, omit TCP Wrapper support, which might allow re… | |
CVE-2008-5516 | | 2009-01-20 | The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search. | |
CVE-2008-2367 | | 2009-01-20 | Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discove… | |
CVE-2009-0171 | | 2009-01-16 | The Sun SPARC Enterprise M4000 and M5000 Server, within a certain range of serial numbers, allows remote attackers to use the manufacturing root password, perf… | |
CVE-2009-0170 | | 2009-01-16 | Sun Java System Access Manager 6.3 2005Q1, 7 2005Q4, and 7.1 allows remote authenticated users with console privileges to discover passwords, and obtain unspec… | |
CVE-2009-0169 | | 2009-01-16 | Sun Java System Access Manager 7.1 allows remote authenticated sub-realm administrators to gain privileges, as demonstrated by creating the amadmin account in… | |
CVE-2009-0122 | | 2009-01-15 | hplip.postinst in HP Linux Imaging and Printing (HPLIP) 2.7.7 and 2.8.2 on Ubuntu allows local users to change the ownership of arbitrary files via unspecified… | |
CVE-2008-5905 | | 2009-01-15 | The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigge… | |
CVE-2008-5462 | | 2009-01-14 | Unspecified vulnerability in the WebLogic Portal component in BEA Product Suite 10.3, 10.2, 10.0 MP1, 9.2 MP3, and 8.1 SP6 allows remote attackers to affect co… | |
CVE-2008-5461 | | 2009-01-14 | Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0, and SP7 allows remote attacker… | |
CVE-2008-5459 | | 2009-01-14 | Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality via unknown vectors. | |
CVE-2009-0024 | | 2009-01-13 | The sys_remap_file_pages function in mm/fremap.c in the Linux kernel before 2.6.24.1 allows local users to cause a denial of service or gain privileges via uns… | |
CVE-2008-5901 | | 2009-01-12 | iyzi Forum 1.0 beta 3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database… | |
CVE-2008-5900 | | 2009-01-12 | CodeAvalanche Articles stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database… | |
CVE-2008-5899 | | 2009-01-12 | CodeAvalanche FreeForAll stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the databa… | |
CVE-2008-5898 | | 2009-01-12 | CodeAvalanche Directory stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the databas… | |
CVE-2008-5897 | | 2009-01-12 | CodeAvalanche FreeWallpaper stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the dat… | |
CVE-2008-5896 | | 2009-01-12 | CodeAvalanche RateMySite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the databa… | |
CVE-2008-5886 | | 2009-01-12 | TAKempis Discussion Web 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the dat… | |
CVE-2008-5885 | | 2009-01-12 | The Net Guys ASPired2Quote stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the data… | |
CVE-2009-0108 | | 2009-01-09 | PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via modified (1) PHPAUCTION_RM_ID, (2) PHPAU… | |
CVE-2009-0043 | | 2009-01-08 | The smmsnmpd service in CA Service Metric Analysis r11.0 through r11.1 SP1 and Service Level Management 3.5 does not properly restrict access, which allows rem… | |
CVE-2008-5873 | | 2009-01-08 | Yerba SACphp 6.3 and earlier allows remote attackers to bypass authentication and gain administrative access via a galleta[sesion] cookie that has a value begi… | |
CVE-2008-5855 | | 2009-01-06 | myPHPscripts Login Session 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to discover user… | |
CVE-2008-5853 | | 2009-01-06 | Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with insufficient access control, which allow… | |
CVE-2008-5852 | | 2009-01-06 | Emefa Guestbook 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database fi… | |
CVE-2008-5846 | | 2009-01-05 | Six Apart Movable Type (MT) before 4.23 allows remote authenticated users with create permission for posts to bypass intended access restrictions and publish p… | |
CVE-2008-5840 | | 2009-01-05 | PHP iCalendar 2.24 and earlier allows remote attackers to bypass authentication by setting the phpicalendar and phpicalendar_login cookies to 1. | |
CVE-2008-5780 | | 2008-12-30 | Forest Blog 1.3.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file… | |
CVE-2008-5773 | | 2008-12-30 | Nukedit 4.9.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file con… | |
CVE-2008-5765 | | 2008-12-30 | WorkSimple 1.2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file… | |
CVE-2008-5762 | | 2008-12-30 | Simple Text-File Login Script (SiTeFiLo) 1.0.6 stores sensitive information under the web root with insufficient access control, which allows remote attackers… | |
CVE-2008-5738 | | 2008-12-26 | Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the nodstrumCalendarV2 cookie to… | |
CVE-2008-5736 | | 2008-12-26 | Multiple unspecified vulnerabilities in FreeBSD 6 before 6.4-STABLE, 6.3 before 6.3-RELEASE-p7, 6.4 before 6.4-RELEASE-p1, 7.0 before 7.0-RELEASE-p7, 7.1 befor… | |
CVE-2008-5725 | | 2008-12-26 | The NT kernel-mode driver (aka pstrip.sys) 5.0.1.1 and earlier in EnTech Taiwan PowerStrip 3.84 and earlier allows local users to gain privileges via certain I… | |
CVE-2008-5724 | | 2008-12-26 | The Personal Firewall driver (aka epfw.sys) 3.0.672.0 and earlier in ESET Smart Security 3.0.672 and earlier allows local users to gain privileges via a crafte… | |
CVE-2008-5716 | | 2008-12-24 | xend in Xen 3.3.0 does not properly restrict a guest VM's write access within the /local/domain xenstore directory tree, which allows guest OS users to cause a… | |
CVE-2008-5699 | | 2008-12-22 | The name service cache daemon (nscd) in Sun Solaris 10 and OpenSolaris snv_50 through snv_104 does not properly check permissions, which allows local users to… | |
CVE-2008-5687 | | 2008-12-19 | MediaWiki 1.11, and other versions before 1.13.3, does not properly protect against the download of backups of deleted images, which might allow remote attacke… | |
CVE-2008-5675 | | 2008-12-19 | Unspecified vulnerability in IBM WebSphere Portal 6.0 before 6.0.1.5 has unknown impact and attack vectors related to "Access problems with BasicAuthTAI." | |
CVE-2008-5673 | | 2008-12-19 | PHParanoid before 0.4 does not properly restrict access to the members area by unauthenticated users, which has unknown impact and remote attack vectors. | |
CVE-2008-5512 | | 2008-12-17 | Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1… | |
CVE-2008-5506 | | 2008-12-17 | Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass th… | |
CVE-2008-5505 | | 2008-12-17 | Mozilla Firefox 3.x before 3.0.5 allows remote attackers to bypass intended privacy restrictions by using the persist attribute in an XUL element to create and… | |
CVE-2008-5504 | | 2008-12-17 | Mozilla Firefox 2.x before 2.0.0.19 allows remote attackers to run arbitrary JavaScript with chrome privileges via vectors related to the feed preview, a diffe… | |
CVE-2008-5625 | | 2008-12-17 | PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows… | |
CVE-2008-5624 | | 2008-12-17 | PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-depend… | |
CVE-2008-5617 | | 2008-12-17 | The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended acces… | |
CVE-2008-4234 | | 2008-12-17 | Incomplete blacklist vulnerability in the Quarantine feature in CoreTypes in Apple Mac OS X 10.5 before 10.5.6 allows user-assisted remote attackers to execute… | |
CVE-2008-5608 | | 2008-12-16 | ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file vi… | |
CVE-2008-5606 | | 2008-12-16 | Gazatem QMail Mailing List Manager 1.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to downl… | |
CVE-2008-5603 | | 2008-12-16 | ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via… | |
CVE-2008-5602 | | 2008-12-16 | Natterchat 1.12 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file v… | |
CVE-2008-5601 | | 2008-12-16 | User Engine Lite ASP stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database f… | |
CVE-2008-5600 | | 2008-12-16 | Merlix Teamworx Server stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database… | |
CVE-2008-5597 | | 2008-12-16 | Cold BBS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a di… | |
CVE-2008-5596 | | 2008-12-16 | Ikon AdManager 2.1 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the… | |
CVE-2008-5592 | | 2008-12-16 | Nightfall Personal Diary 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the da… |