CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5129
https://notcve.org/view.php?id=CVE-2007-5129
SimpGB 1.46.02 stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) obtain sensitive configuration information via a direct request for admin/cfginfo.php; and (2) download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc. SimpGB 1.46.02 almacena información sensible bajo la raíz de documentos web con control de acceso insuficiente, lo cual permite a atacantes remotos (1) obtener información sensible de la configuración mediante una petición directa a admin/cfginfo.php; y (2) descargar ficheros .inc de su elección mediante una petición directa, como ha sido demostrado por admin/includes/dbtables.inc. • http://forum.boesch-it.de/viewtopic.php?t=2790 http://osvdb.org/40612 http://osvdb.org/40613 http://secunia.com/advisories/26974 http://www.netvigilance.com/advisory0065 http://www.netvigilance.com/advisory0066 http://www.securityfocus.com/archive/1/480590/100/0/threaded http://www.securityfocus.com/archive/1/480592/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/36776 https://exchange.xforce.ibmcloud.com/vulnerabilities/36777 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5130
https://notcve.org/view.php?id=CVE-2007-5130
SimpGB 1.46.02 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php or (2) a direct request to admin/trailer.php, which reveals the path in various error messages. SimpGB 1.46.02 permite a atacantes remotos obtener información sensible mediante (1) un parámetro lang a admin/index.php o (2) una petición directa a admin/trailer.php, lo cual revela la ruta en varios mensajes de error. • http://forum.boesch-it.de/viewtopic.php?t=2790 http://securityreason.com/securityalert/3172 http://www.netvigilance.com/advisory0064 http://www.securityfocus.com/archive/1/480593/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/36775 • CWE-20: Improper Input Validation •