IBM-HTTP-Server View Code

IBM's HTTP Server on the AS/400 platform is vulnerable to an attack that will show the source code of the page -- such as an .html or .jsp page -- by attaching an '/' to the end of a URL. Example: http://www.example.com/getsource.jsp/ OpenVAS Vulnerability Test $Id: ibmservercode.nasl 8023...

CVE-2002-1822

CVE-2002-1822 concerns IBM HTTP Server 1.0 on AS/400, where remote attackers can obtain the web root path and other sensitive information. The leak occurs via an error message when requesting a non-existent JSP page. The vulnerability is documented with a NVD CVSS v2 base score of 5.0 (Medium) an...

CVE-2002-1822

IBM HTTP Server 1.0 on AS/400 allows remote attackers to obtain the path to the web root directory and other sensitive information, which is leaked in an error mesage when a request is made for a non-existent Java Server Page JSP...

CVE-2002-1731

The System Request menu in IBM AS/400 allows local users to list valid user accounts by viewing the object names that are type USRPRF...

CVE-2002-1731

Technical details about CVE-2002-1731 are not publicly available in the provided documents. Monitor for updates in connected sources for affected products, root cause specifics, and remediation guidance.

CVE-2005-1025

The FTP server in AS/400 4.3, when running in IFS mode, allows remote attackers to obtain sensitive information via a symlink attack using RCMD and the ADDLNK utility, as demonstrated using the QSYS.LIB library...

CVE-2005-1239

Directory traversal vulnerability in the third party tool from Raz-Lee, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...

CVE-2005-1242

Directory traversal vulnerability in the third party tool from Bsafe, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...

CVE-2005-0868

AS/400 Telnet 5250 terminal emulation clients, as implemented by 1 IBM client access, 2 Bosanova, 3 PowerTerm, 4 Mochasoft, and possibly other emulations, allows malicious AS/400 servers to execute arbitrary commands via a STRPCO Start PC Organizer command followed by STRPCCMD Start PC command, a...

CVE-2005-1238

By design, the built-in FTP server for iSeries AS/400 systems does not support a restricted document root, which allows attackers to read or write arbitrary files, including sensitive QSYS databases, via a full pathname in a GET or PUT request...

CVE-2005-1243

Directory traversal vulnerability in the third party tool from SafeStone, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...

CVE-2005-0899

AS/400 running OS400 5.2 installs and enables LDAP by default, which allows remote authenticated users to obtain OS/400 user profiles by performing a search...

CVE-2005-1133

The POP3 server in IBM iSeries AS/400 returns different error messages when the user exists or not, which allows remote attackers to determine valid user IDs on the server...

CVE-2005-1239

CVE-2005-1239 describes a directory-traversal flaw in Raz‑Lee’s third‑party tool used with the iSeries (AS/400) FTP server. The vulnerability allows remote attackers to access arbitrary files, including those in qsys.lib, by sending crafted "." sequences in a GET request. Publicly available refer...

CVE-2005-1241

CVE-2005-1241 describes a directory traversal in the Powertech third‑party tool used with the iSeries AS/400 FTP server, enabling remote access to arbitrary files (including those in qsys.lib) via ".." in GET requests. The initial and connected records present no explicit patch or version details...

CVE-2005-1238

By design, the built-in FTP server for iSeries AS/400 systems does not support a restricted document root, which allows attackers to read or write arbitrary files, including sensitive QSYS databases, via a full pathname in a GET or PUT request...

CVE-2005-1240

The CVE-2005-1240 entry describes a directory traversal vulnerability in Castlehill’s third-party tool used to secure the iSeries AS/400 FTP server. Attackers could access arbitrary files (including from qsys.lib) by crafting GET requests containing ".." sequences. The provided description does n...

CVE-2005-1244

Directory traversal vulnerability in the third party tool from NetIQ, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request. NOTE: the vendor has disputed this issue, saying that...

CVE-2005-1238

CVE-2005-1238 affects the built-in FTP server for IBM iSeries AS/400 systems. The root cause is failure to enforce a restricted document root, enabling an attacker to read or write arbitrary files, including sensitive QSYS databases, by sending a full pathname in a GET or PUT request. Impact per ...

CVE-2005-1240

Directory traversal vulnerability in the third party tool from Castlehill, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...