CVE-2006-0370

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://evuln.com/vulns/42/summary.htmlExploit, Vendor Advisory
http://secunia.com/advisories/18547Vendor Advisory
http://securitytracker.com/id?1015523
http://www.fluffington.com/index.php?page=rcblogURL Repurposed
http://www.osvdb.org/22679
http://www.securityfocus.com/archive/1/422499/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/24249
http://evuln.com/vulns/42/summary.htmlExploit, Vendor Advisory
http://secunia.com/advisories/18547Vendor Advisory
http://securitytracker.com/id?1015523
http://www.fluffington.com/index.php?page=rcblogURL Repurposed
http://www.osvdb.org/22679
http://www.securityfocus.com/archive/1/422499/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/24249

Timeline

Published: Jan 22, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-03715.0Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly in CVE-2006-03727.5Multiple SQL injection vulnerabilities in config.php in Insane Visions BlogPHP, possibly 1.0, allow remote attackers to execute arbitrary SQ CVE-2006-03734.3Cross-site scripting (XSS) vulnerability in register.aspx in Douran FollowWeb allows remote attackers to inject arbitrary web script or HTML CVE-2006-03747.5Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 has multiple undocumented ports available, which (1 CVE-2006-03755.0Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 on VxWorks uses a hardcoded Network Time Protocol (CVE-2006-03767.5The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user w CVE-2006-03775.0CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters CVE-2006-03784.3Cross-site scripting (XSS) vulnerability in Netrix X-Site Manager allows remote attackers to inject arbitrary web script or HTML via the pro CVE-2006-03792.1FreeBSD kernel 5.4-STABLE and 6.0 does not completely initialize a buffer before making it available to userland, which could allow local us CVE-2006-03802.1A logic error in FreeBSD kernel 5.4-STABLE and 6.0 causes the kernel to calculate an incorrect buffer length, which causes more data to be c CVE-2006-03815.0A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub CVE-2006-03822.1Apple Mac OS X 10.4.5 and allows local users to cause a denial of service (crash) via an undocumented system call.