Septemb0X

**Name of the Vulnerable Software and Affected Versions** Uebimiau Webmail version 3.2.0-2.0 **Description** The issue allows remote attackers to download a database containing usernames and password hashes by making a direct request for the "system admin/admin.ucf" file. This is possible due to insufficient access control over sensitive information stored under the web root. **Recommendations** For Uebimiau Webmail version 3.2.0-2.0, consider restricting access to the "system admin/admin.ucf" file to prevent unauthorized downloads of the database. Additionally, review and improve access controls over sensitive information stored under the web root to prevent similar issues.

**Name of the Vulnerable Software and Affected Versions** DM Albums version 1.9.2 **Description** A remote file inclusion issue in the template/album.php file allows remote attackers to execute arbitrary PHP code via a URL in the `SECURITY FILE` parameter. **Recommendations** For DM Albums version 1.9.2, consider restricting access to the `template/album.php` file until a patch is available, and avoid using the `SECURITY FILE` parameter in the affected endpoint.

**Name of the Vulnerable Software and Affected Versions** DM FileManager version 3.9.4 **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `SECURITY FILE` parameter when `register globals` is enabled. **Recommendations** For DM FileManager version 3.9.4, consider disabling the `register globals` setting to prevent exploitation until a patch is available. Restrict access to the `album.php` file in the `dm-albums/template` directory to minimize the risk of exploitation. Avoid using the `SECURITY FILE` parameter in the affected URL until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ARD-9808 DVR card (affected versions not specified) **Description** The issue concerns the storage of sensitive information under the web root with insufficient access control. This allows remote attackers to download a file containing usernames and passwords via a direct request for "dvr.ini". **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.