140 matches found
CVE-2002-1635
The Apache configuration file httpd.conf in Oracle 9i Application Server 9iAS uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin...
PHP Resource Exhaustion Denial of Service
The PHP interpreter is a heavy-duty CGI EXE or SAPI module, depending on configuration that implements an HTML-embedded script language. A vulnerability in PHP can be used to cause a denial of service in some cases. PHP's install process on Apache requires a "/php/" alias to be created, as it...
PHP Interpreter 3.0.x4.0.x4.14.2 - Direct Invocation Denial of Service
PHP Interpreter 3.0.x4.0.x4.14.2 - Direct Invocation Denial of Service // source: https://www.securityfocus.com/bid/5280/info It is possible, under some circumstances, for remote attackers to invoke the PHP interpreter from the web. If the interpreter is invoked with no command line options, it...
CVE-2002-0240
PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message...
Oracle 9iAS allows access to CGI script source code within CGI-BIN directory
Overview Oracle 9i Application Server 9iAS allows remote anonymous users to view source code in CGI scripts stored in the Apache cgi-bin. Attackers may analyze these scripts to discover usernames, passwords, or other proprietary data or methods. Description The default Apache configuration file i...
MandrakeSoft Mandrake Linux Apache default configuration enables directory indexing
Overview The default installation of Apache on MandrakeSoft Mandrake Linux enables directory indexing on directories that may unnecessarily disclose information about the server. Description MandrakeSoft produces a Linux distribution called Mandrake Linux that includes the Apache web server. The...
Tripwire for Webpages Installation Disclosure
The remote host is running Tripwire for Webpages, a commercial product to monitor for changes in web pages. This information may prove useful to anyone doing reconnaissance before launching an actual attack. %NASLMINLEVEL 70300 C Tenable Network Security include'deprecatednasllevel.inc';...
Mac OS X - Apache & Case Insensitive Filesystems
Environment: Mac OS X 10.0.3 / Darwin 1.3.3 Apache 1.3.14 This is the the default setup, out of the box, with available software updates installed. Please note, this is OS X Client. Who is affected: Everybody who used Apache on Mac OS X Client with the following conditions: + Documents are on a...
CVE-2000-0868
The default configuration of Apache 1.3.12 in SuSE Linux 6.4 allows remote attackers to read source code for CGI scripts by replacing the /cgi-bin/ in the requested URL with /cgi-bin-sdb/...
CVE-2000-1016
The default configuration of Apache httpd.conf on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to read package documentation and obtain system configuration information via an HTTP request for the /doc/packages URL...
CVE-2000-0869
The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP request method...
Apache 1.3.14 available
Several security problems have been found in the Apache web server software. It is recommended that all users of Apache upgrade to the latest stable release to fix these problems. Apache is included in our N software series in the apache.tgz package. A new apache.tgz package including Apache 1.3....
SuSE Linux 6.3/6.4 - Installed Package Disclosure
source: https://www.securityfocus.com/bid/1707/info By submitting a specific url to the web server "http://hosts.any/doc/packages/" , any user from any host may obtain a list of packages installed on a S.u.S.E 6.3 or 6.4 system. This problem is due to a configuration in the Apache httpd.conf...
SuSE Linux 6.36.4 - Installed Package Disclosure
SuSE Linux 6.36.4 - Installed Package Disclosure source: https://www.securityfocus.com/bid/1707/info By submitting a specific url to the web server "http://hosts.any/doc/packages/" , any user from any host may obtain a list of packages installed on a S.u.S.E 6.3 or 6.4 system. This problem is due...
@stake Advisory: SuSE Apache CGI Source Code Viewing (A090700-2)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com www.cerberus-infosec.co.uk Security Advisory Release Date: 09/07/2000 Application: Apache 1.3.9/12 Platform: SuSE Linux 6.3 and 6.4 Severity: An attacker can gain access to source code of CGI scripts. As such they may be...
Cobalt apache configuration exposes .htaccess
Following some discussion on the cobalt-users list, it seems that this problem affects both the Raq2 and Raq3. It likely affects other cobalt products, but I haven't confirmed it. I verified this on my Raq2. By default, raq-hosted sites expose .htaccess files to the world. The configuration files...
Cobalt RaQ 2.0/3.0 - Apache .htaccess Disclosure
source: https://www.securityfocus.com/bid/1083/info The default configuration of Cobalt Raq2 and Raq3 servers allows remote access to .htaccess files. This could lead to unauthorized retrieval of username and password information for restricted portions of a website hosted on the server. Make a...
CVE-1999-0678
A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server...
debian.apache.txt
An issue with Apache on Debian Andrei D. Caraman [email protected] Mon, 5 Apr 1999 19:53:35 +0300 Aleph1, I don't remember this being posted on Bugtraq, but feel free to kill it, if it's yesterday's news. This pertains to the Apache configuration as shipped with Debian 2.1 codename slink. The...