CVE-2005-3424

Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.5 allows remote attackers to inject arbitrary web script or HTML via 404 error pages, a different vulnerability than CVE-2005-3425...

httpXSS.txt

The following web servers do not properly sanitize their output when returning a 404 resource not found error which could be used in a XSS attack: Orion 1.3.8 Orion 1.4.5 CompaqHTTPServer 2.1 PoC: http://localhost/alert'XSS' -- - Josh...

CVE-2005-2982

Cross-site scripting XSS vulnerability in CompaqHTTPServer 2.1 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting 404 error page...

CVE-2005-2981

Cross-site scripting XSS vulnerability in Orion 1.3.8 and 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting 404 error page...

CVE-2005-2981

CVE-2005-2981 describes a cross-site scripting (XSS) vulnerability in Orion versions 1.3.8 and 1.4.5 . The issue arises from user-supplied input in the URL not being properly quoted in the resulting 404 error page, enabling an attacker to inject arbitrary script/HTML. The core vulnerability is th...

CVE-2005-2981

Cross-site scripting XSS vulnerability in Orion 1.3.8 and 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting 404 error page...

CVE-2005-2982

CVE-2005-2982 describes a cross-site scripting (XSS) vulnerability in CompaqHTTPServer 2.1 . The issue arises because a URL is not properly quoted in the server’s 404 error page , allowing a remote attacker to inject arbitrary web script or HTML. The description explicitly ties the vulnerability ...

404 error XSS

The following web servers do not properly sanitize their output when returning a 404 resource not found error which could be used in a XSS attack: Orion 1.3.8 Orion 1.4.5 CompaqHTTPServer 2.1 PoC: http://localhost/scriptalert'XSS'/script -- - Josh...

CVE-2002-1700

CVE-2002-1700 describes a cross-site scripting (XSS) flaw in the missing template handler of Macromedia ColdFusion MX. The vulnerability arises because the HTTP request parameter for the template name is not filtered, allowing an attacker to inject script that is echoed in a 404 error message and...

CVE-2002-1700

Cross-site scripting vulnerability XSS in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message...

CVE-2005-1555

Cross-site scripting XSS vulnerability in the JRun Web Server in ColdFusion MX 7.0 allows remote attackers to inject arbitrary script or HTML via the URL, which is not properly quoted in the resulting default 404 error page...

CVE-2005-1555

Cross-site scripting XSS vulnerability in the JRun Web Server in ColdFusion MX 7.0 allows remote attackers to inject arbitrary script or HTML via the URL, which is not properly quoted in the resulting default 404 error page...

Microsoft Internet Explorer 6.0 SP2 - File Download Security Warning Bypass

Orginal Advisory and exploit by cyberflash Vengy Circumvent Windows XP SP2 security features using execCommand 'SaveAs' function! Demonstration: Notice that you don't receive any warning messages such as: "File Download - Security Warning" or "Open File - Security Warning". If "Hide file extensio...

CVE-2004-1354

The Solaris Management Console SMC in Sun Solaris 8 and 9 generates different 404 error messages when a file does not exist versus when a file exists but is otherwise inaccessible, which could allow remote attackers to obtain sensitive information in conjunction with a directory traversal .. atta...

Fastream NetFile crossite scripting

Crossite scripting on 404 error page...

CVE-2002-0733

CVE-2002-0733 is a cross-site scripting vulnerability in thttpd 2.20 and earlier. The issue arises when a crafted URL to a nonexistent page is inserted into a 404 error page, enabling remote attackers to execute arbitrary script in the context of the user viewing the error page. The connected dat...

CVE-2002-2246

Cross-site scripting XSS vulnerability in VisNetic Website before 3.5.15 allows remote attackers to inject arbitrary web script or HTML via the HTTP referer header HTTPREFERER to a non-existent page, which is injected into the resulting 404 error page...

CVE-2002-1700

Cross-site scripting vulnerability XSS in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message...

Apache Host: crossite scripting

404 error message contains unescaped Host: header of HTTP request...

Web Server No 404 Error Code Check

The remote web server is configured such that it does not return '404 Not Found' error codes when a nonexistent file is requested, perhaps returning instead a site map, search page or authentication page. Nessus has enabled some counter measures for this. However, they might be insufficient. If a...