Improper Handling of Windows Device Names

Overview Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via the safejoin function. An attacker can cause the application to hang indefinitely by requesting a path ending with a Windows special device name, e.g. CON or NUL. Note: This is only vulnerab...

CVE-2002-1989: Undefined Security Weakness

Resin 2.1.1 allows remote attackers to cause a denial of service thread and connection consumption via multiple URL requests containing the DOS 'CON' device name and a registered file extension such as .jsp or .xtp...

CVE-2003-1205: Undefined Security Weakness

Crob FTP Server 2.60.1 allows remote authenticated users to cause a denial of service crash by renaming a file to the "con" MS-DOS device name...