CVE-2000-0628

The source.asp example script in the Apache ASP module Apache::ASP 1.93 and earlier allows remote attackers to modify files...

CVE-2000-0628

The CVE-2000-0628 entry concerns the Apache::ASP 1.93 and earlier, where the source.asp example script in the Apache ASP module allows remote attackers to modify files. The vulnerability pertains to the source.asp file (/site/eg/source.asp in exposed deployments) which comes with the Apache::ASP ...

Microsoft IIS Translate f: ASP/ASA Source Disclosure

There is a serious vulnerability in Windows 2000 unpatched by SP1 that allows an attacker to view ASP/ASA source code instead of a processed file. SP source code can contain sensitive information such as usernames and passwords for ODBC connections. %NASLMINLEVEL 70300 This script was written by...

Translate:f summary, history and thoughts

Because Microsoft went the way of HIDING the actual mechanism of Translate:f from all of us original KB article is gone and new Security Bulletin is playing nasty game of downplaying the problem, i have decided to write follow up with sufficient information. HOW IT WORKS -------------------------...

Заткнута дырка в IIS (Specialized Header)

При определенном HTTP-заголовке запроса можно было получить исходные тексты ASP-приложения...

srcgrab.pl.txt

Subject: Re: Translate:f summary, history and thoughts Simple perl script exploit for the problem. Please find a simple perl script included at the bottom that exploits below described problem. ----- Original Message ----- From: "Daniel Doèekal" To: Sent: Tuesday, August 15, 2000 7:39 PM Subject:...

Apache ASP module Apache::ASP source.asp Example File Arbitrary File Creation

The file /site/eg/source.asp is present on the remote Apache web server. This file comes with the Apache::ASP package and allows anyone to write to files in the same directory. An attacker may use this flaw to upload his own scripts and execute arbitrary commands on this host. C Tenable Network...

CVE-2000-0396

The add.exe program in the Carello shopping cart software allows remote attackers to duplicate files on the server, which could allow the attacker to read source code for web scripts such as .ASP files...

CVE-2000-0396

CVE-2000-0396 affects the add.exe component of the Carello shopping cart software. The vulnerability allows remote attackers to duplicate files on the server, which could enable reading source code of web scripts such as .ASP files. The NVD entry lists a MEDIUM base score (5.0) with network impac...

ANNOUNCE Apache::ASP v1.95 - Security Hole Fixed

ANNOUNCE Apache::ASP v1.95 - Security Hole Fixed Apache::ASP http://www.nodeworks.com/asp/ had a security hole in its ./site/eg/source.asp distribution examples file, allowing a malicious hacker to potentially write to files in the directory local to the source.asp example script. The next versio...

Дырка в Apache::ASP

Один из файлов с примерами ./site/eg/source.asp позволяет перезаписать файл в локальной директории...

CVE-2000-0628

The source.asp example script in the Apache ASP module Apache::ASP 1.93 and earlier allows remote attackers to modify files...

CVE-2000-0246

The vulnerability CVE-2000-0246 affects Microsoft IIS 4.0/5.0 where ISAPI extension processing fails for a virtual directory mapped to a UNC share, enabling remote attackers to read ASP source and other files. OpenVAS/Nessus entries confirm ASP/HTR source disclosure via UNC-path access. No remedi...

Дырка в Carello shopping cart

Можно создавать файл на сервере или переименовывать существующие файлы. Таким образом можно, нпример, получить исходные тексты .asp - файла...

razor.dvwssr.txt

BindView RAZOR Team Analysis of DVWSSR.DLL Risks Risks Uncovered: ================ The risks of having dvwssr.dll are not as severe as originally reported in media outlets Friday morning, but still severe enough that system administrators responsible for NT systems to investigate. The risks invol...

Еще одна опасная уязвимость в IIS

ISAPI-приложение /vtibin/vtiaut/dvwssr.dll устанавливаемое вместе с IIS позволяет получить доступ к любому .asp - документу на сервере. Библиотека, по-сути, является "черным ходом", причем в качестве пароля прошита фраза "Netscape engineers are weenies!" записанная задом наперед. Хотя разрешения...

RFP2K02.txt

----- UMBRA Advisory RFP2K02 -------------------------- rfp.labs --------- "Netscape engineers are weenies!" A back door in Microsoft FrontPage extensions/authoring components ------------------------------------- Alf Serer / [email protected] - rain forest puppy / [email protected] Table of...

Microsoft IIS/PWS %2e Request ASP Source Disclosure

It is possible to get the source code of a remote ASP script by appending '%2e' to the end of the request. ASP source code usually contains sensitive information such as logins and passwords. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10363; scriptversion "1.35";...

Microsoft IIS ASP::$DATA ASP Source Disclosure

It is possible to get the source code of a remote ASP script by appending '::$DATA' to the end of the request. ASP source code may contain sensitive information such as logins, passwords and server information. %NASLMINLEVEL 70300 This script was written by Renaud Deraison See the Nessus Scripts...

Alert: MS Index Server (CISADV000330)

Cerberus Information Security Advisory CISADV000330 http://www.cerberus-infosec.co.uk/advisories.shtml Released : 30th March 2000 Name : Index Server Strike 3! Affected Systems : Microsoft Internet Information Server Issue : Attackers can gain source of ASP and other pages Author : David Litchfie...