CVE-2008-2168

CVE-2008-2168 : The linked SUSE/NVD entries describe a cross-site scripting (XSS) vulnerability in Apache HTTP Server up to version 2.2.6 and earlier, exploitable via UTF-7 encoded URLs that are mishandled when rendering the 403 Forbidden error page. Attacker-provided URL input can inject arbitra...

CVE-2008-2168

Cross-site scripting XSS vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page...

CVE-2008-2168

Cross-site scripting XSS vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page...

CVE-2008-2168: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page...

apache-utf7xss.txt

Apache Server HTML Injection and UTF-7 XSS Vulnerability This vulnerability was found by Yaniv Miron and Yossi Yakubov. This vulnerability will allow an attacker to inject an XSS to any Apache server that use the Forbidden 403 default page. After injecting this string:...

Debian Security Advisory DSA 403-1 (kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386, kernel-source-2.4.18)

The remote host is missing an update to kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386, kernel-source-2.4.18 announced via advisory DSA 403-1. OpenVAS Vulnerability Test $Id: deb4031.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 403-1 Authors:...

Debian Security Advisory DSA 403-1 (kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386, kernel-source-2.4.18)

The remote host is missing an update to kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386, kernel-source-2.4.18 announced via advisory DSA 403-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...

RunCMS <= 1.6 disclaimer.php Remote File Overwrite Exploit

Exploit for unknown platform in category web applications ========================================================== RunCMS RunCmss Bug Yahoo! Crawler body font-size: 10px; font-family: verdana; INPUT BORDER-TOP-WIDTH: 1px; FONT-WEIGHT: bold; BORDER-LEFT-WIDTH: 1px; FONT-SIZE: 10px;...

Уязвимость в Денвере-2: XSS

Здравствуйте, vuln. Найдена уязвимость типа XSS в пакете для web-разработчика Денвер-2 http://www.denwer.ru/ Пример: www.site.ru/scriptalert'XSS!'/script появится страница с сообщением об ошибке 403 и выполнится скрипт Уязвимость возможна из-за ошибки в файле, появляющемся при ошибке 403. Его...

CVE-2002-2094: Observable Discrepancy

Joe Testa hellbent 01 allows remote attackers to determine the full path of the web root directory via a GET request with a relative path that includes the root's parent, which generates a 403 error message if the parent is incorrect, but a normal response if the parent is correct...

CVE-2001-1202

CVE-2001-1202 affects DeleGate versions 7.7.0 and 7.7.1. The root cause is that scripting commands are not quoted in a 403 Forbidden error page, enabling remote attackers to trigger cross‑site scripting by using a URL that generates an error. Consequence is arbitrary Javascript execution on other...

CVE-2001-1202: Undefined Security Weakness

Cross-site scripting vulnerability in DeleGate 7.7.0 and 7.7.1 does not quote scripting commands within a "403 Forbidden" error page, which allows remote attackers to execute arbitrary Javascript on other clients via a URL that generates an error...

Oracle 9iAS XSQL Servlet ignores file permissions allowing arbitrary users to view sensitive configuration files

Overview It is possible to read the sensitive configuration files from an Oracle 9i Application Server without any authorization. This can lead to an intruder gaining access to sensitive information about the server and potentially compromising it. Description Default installation of the Oracle 9...