FAT32 directory auth bypass on Linux Abyssws < 1.2

Luigi Auriemma Application: Abyss webserver http://www.aprelium.com Versions: minors than 1.2 Platforms: Linux version only Bug: Bypassing of password protected folders authorization on FAT32 filesystems Risk: medium but rarely users use Linux to run a webserver on a FAT32 partition Exploitation:...

Abyss Web Server 1.0/1.1 - Authentication Bypass

source: https://www.securityfocus.com/bid/9171/info It has been reported that Abyss Web Server is prone to an authentication bypass vulnerability that may allow an attacker to gain access to server resources. This issue may be carried out by accessing a password protected directory under which th...

Abyss Web Server 1.01.1 - Authentication Bypass

Abyss Web Server 1.01.1 - Authentication Bypass source: https://www.securityfocus.com/bid/9171/info It has been reported that Abyss Web Server is prone to an authentication bypass vulnerability that may allow an attacker to gain access to server resources. This issue may be carried out by accessi...

Abyss Web Server GET Request Multiple Vulnerabilities

The remote Abyss Web server is earlier than version 1.1.6. Such versions are reportedly vulnerable to a buffer overflow that could be exploited by an attacker to execute arbitrary code on the host. In addition, it is possible to inject malicious data into server response headers using a specially...

Abyss Webserver multiple bugs

Buffer overflow, HTTP reply spoofing...

[Full-Disclosure] Aprelium Abyss webserver X1 arbitrary code execution and header injection

-- Description -- Abyss Web Server is a free, closed-source, personal web server for Windows and Linux operating systems. Homepage : http://www.aprelium.com The Hackademy Audit team has found two remote security holes in Abyss Webserver X1, allowing arbitrary code execution and header injection. ...

Aprelium Abyss Webserver DoS

Incomplete Connection: and Range: headers cause server to crash...

Abyss X1 1.1.2 remote crash

Application: Abyss Webserver http://www.aprelium.com Versions: X1 v 1.1.2 Platform: Windows and Linux Bug: Crash caused by the reading of an unreacheable memory zone Risk: Remote crash Author: Auriemma Luigi e-mail: [email protected] web: http://www.pivx.com/luigi/ 1 Introduction 2 Bug 3 The Code 4...

Abyss Web Server Malformed GET Request Remote DoS

It was possible to kill the remote web server by sending empty HTTP request headers namely Connection: or Range:. An attacker may use this flaw to crash the affected application, thereby denying service to legitimate users. C Tenable Network Security, Inc. References: Date: Sat, 5 Apr 2003 12:21:...

Abyss Web Server 1.1.2 - Incomplete HTTP Request Denial of Service

Abyss Web Server 1.1.2 - Incomplete HTTP Request Denial of Service source: https://www.securityfocus.com/bid/7287/info A denial of service vulnerability has been reported for Abyss Web Server. The vulnerability exists when Abyss attempts to parse certain incomplete HTTP headers. GET / HTTP/1.0...

Abyss Web Server 1.1.2 - Incomplete HTTP Request Denial of Service

source: https://www.securityfocus.com/bid/7287/info A denial of service vulnerability has been reported for Abyss Web Server. The vulnerability exists when Abyss attempts to parse certain incomplete HTTP headers. GET / HTTP/1.0 Connection: GET / HTTP/1.0 Range:...

abyss.txt

Application: Abyss Webserver http://www.aprelium.com Versions: X1 v 1.1.2 Platform: Windows and Linux Bug: Crash caused by the reading of an unreacheable memory zone Risk: Remote crash Author: Auriemma Luigi e-mail: [email protected] web: http://www.pivx.com/luigi/ 1 Introduction 2 Bug 3 The Code 4...

CVE-2002-1081

The CVE-2002-1081 entry concerns Abyss Web Server 1.0.3. Affected component: the Administration console. Root cause: remote authentication bypass allows reading files by issuing an HTTP request to a target file whose path ends with a "+" character. Impact: unauthorized disclosure of files without...

CVE-2002-1079

Directory traversal vulnerability in Abyss Web Server 1.0.3 allows remote attackers to read arbitrary files via ..\ dot-dot backslash sequences in an HTTP GET request...

CVE-2002-1081

The Administration console for Abyss Web Server 1.0.3 allows remote attackers to read files without providing login credentials via an HTTP request to a target file that ends in a "+" character...

CVE-2002-0543

Directory traversal vulnerability in Aprelium Abyss Web Server abyssws before 1.0.0.2 allows remote attackers to read files outside the web root, including the abyss.conf file, via URL-encoded .. dot dot sequences in the HTTP request...

CVE-2002-1079

Affects Abyss Web Server 1.0.3. Directory traversal allows remote read of arbitrary files via ..\ in HTTP GET requests; impact is partial confidentiality of data. No explicit remediation details are provided in the connected documents.

CVE-2002-0543

The vulnerability affects Aprelium Abyss Web Server (abyssws) prior to version 1.0.0.2. It is a directory traversal flaw that allows remote attackers to read files outside the web root by supplying URL-encoded .. sequences in the HTTP request, potentially exposing sensitive files such as abyss.co...

Abyss password bruteforcing

Unlimited number of password attempt on 9999 port with no logging...

Abyss WebServer Brute Force Vulnerability

Abyss WebServer Brute Force Vulnerability Package: Abyss WebServer Vendor Web Site: http://www.aprelium.com Versions: All versions = v1.1.2 Platforms: Linux, Windows Local: No Remote: Yes Fix Available: Nofix in progress Vendor Contacted: Sunday, February 09, 2003 6:12 PM Advisory Author: thomas...