CVE

Id
28635  
CVE No.
CVE-2007-5278  
Status
Candidate  
Description
Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to download files that were uploaded by users, as demonstrated by obtaining a directory listing via a direct request to /upload and then retrieving individual files. NOTE: in a non-default configuration, the directory listing is denied, but filenames may be predicable.  
Phase
Assigned (20071008)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
298445 28635 CVE-2007-5278 MILW0RM:4466  View
298446 28635 CVE-2007-5278 URL:http://www.milw0rm.com/exploits/4466  View
298447 28635 CVE-2007-5278 BID:25861  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
54057 JVNDB-2007-002749 AppFuse の messages.jsp におけるクロスサイトスクリプティングの脆弱性 AppFuse の messages.jsp には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2007-5280 28635 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-002749.html  View