Opera 7.0 - Error Message History Disclosure

source: https://www.securityfocus.com/bid/6759/info It has been reported that Opera fails to ensure that a remote site has proper authorization before executing some methods used to access error messages stored in the Opera console. This issue is further exacerbated by the fact that error message...

Apache Tomcat multiple bugs

Multiple vulnerability allow directory browsing and source code disclosure...

CVE-2002-2065

WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root...

CVE-2002-0466

Hosting Controller 1.4.1 and earlier allows remote attackers to browse arbitrary directories via a full C: style pathname in the filepath arguments to 1 Statsbrowse.asp, 2 servubrowse.asp, 3 browsedisk.asp, 4 browsewebalizerexe.asp, or 5 sqlbrowse.asp...

CVE-2002-0466

The CVE-2002-0466 entry concerns Hosting Controller (version 1.4.1 and earlier). The connected OpenVAS entries describe vulnerable ASP pages for Hosting Controller, indicating multiple remote exploits exist that could be used to access confidential data or escalate privileges on the Web server. T...

CVE-2002-0466

Hosting Controller 1.4.1 and earlier allows remote attackers to browse arbitrary directories via a full C: style pathname in the filepath arguments to 1 Statsbrowse.asp, 2 servubrowse.asp, 3 browsedisk.asp, 4 browsewebalizerexe.asp, or 5 sqlbrowse.asp...

Another vulnerability in hosting controller

1/If admin doesn't change or delete user AdvWebadmin, the default password of this user is advcomm500349, you can creat your own account or use this account to hack the server. 1/ A foolish vulnerability, i can view the harddisk by using the file browse.asp in directory admin...

Hosting Controller's - Multiple Security Vulnerabilities

Hosting Controller - Multiple security vulnerabilities Release Date: 01/04/2002 Summary Hosting Controller is an all in one administrative hosting tools for Windows. It automates all hosting tasks and gives full control of each website to the respective owners. Hosting Controller is used widely b...

Aspupload installs exploitable scripts

Title: ASPUPLOAD Installs Exploitable Scripts By Default http://www.aspupload.com/ Author: Brett Moore [email protected] Systems Affected: Version 2.1 On Windows Version 3.0 Was Not Available For Testing Release Date: 30/11/2001 Vendor Contacted: 31/10/2001 Vendor Responded:31/10/2001...

def-2001-32

====================================================================== Defcom Labs Advisory def-2001-32 Allaire JRun directory browsing vulnerability Author: George Hedfors [email protected] Release Date: 2001-11-28 ======================================================================...

Groupwise Webaccess, NetWare web server, and Novell

No idea if this is what the Groupwise Padlock http://www.novell.com/padlock thing is about, since Novell is not only vague in the issues, but never acknowledged Adept's findings. - Simple Nomad - "No rest for the Wicca'd" - - [email protected] - - - [email protected] - www.nmrc.org...

groupwise.disclosure.txt

No idea if this is what the Groupwise Padlock http://www.novell.com/padlock thing is about, since Novell is not only vague in the issues, but never acknowledged Adept's findings. - Simple Nomad - "No rest for the Wicca'd" - - [email protected] - - - [email protected] - www.nmrc.org...

Дырка в BrokerFTP (unauthorized directory browsing)

Команда ls и dele позволяет прочитать/удалить содержимое любого диска. Кроме того, пароли и разрешения хранятся в реестре в открытом виде. Большое количество других ошибок...

Acme.Server v1.7 of 13nov96 Directory Browsing

---------------------------------------------------------------------- Date: 31.05.2001 Affected Software: Acme.Serve v1.7 of 13nov96 http://www.acme.com Exploit: Browsing of directories and files allowed to unauthorized users Keywords: Cisco Secure Administration, Netscape FastTrack, ... Contact...

CVE-2001-0200

HSWeb 2.0 HTTP server allows remote attackers to obtain the physical path of the server via a request to the /cgi/ directory, which will list the path if directory browsing is enabled...

def-2001-14: Bea Weblogic Unicode Directory Browsing

====================================================================== Defcom Labs Advisory def-2001-14 Bea Weblogic Unicode Directory Browsing Author: Peter Grьndl [email protected] Release Date: 2001-03-26 ======================================================================...

Дырка в BEA Weblogic (directory browsing)

Используя escape-символы 00, 2e, 2f, 5c можно получить содержимое каталога...

Re: def-2001-14: Bea Weblogic Unicode Directory Browsing

It is interesting to note that similar in fact, worse behaviour is exhibited in both Weblogic 4.5.1 and 5.1. Appending a '00' to the end of a .jsp request retrieves the source of the jsp. So far I have been able to demonstrate this on several, but not all of my weblogic farm. Results look somethi...

CVE-2001-0200

HSWeb 2.0 HTTP server allows remote attackers to obtain the physical path of the server via a request to the /cgi/ directory, which will list the path if directory browsing is enabled...

CVE-2001-0200

HSWeb 2.0 HTTP server is affected by a path-disclosure vulnerability: remote attackers can obtain the server’s physical path by requesting the /cgi/ directory if directory browsing is enabled. This results in partial confidentiality impact. The available sources do not provide exploit details, af...