Design/Logic Flaw

Orion Application Server before 2.0.7, when running on Windows, allows remote attackers to obtain the source code of JSP files via 1 . dot and 2 space characters in the extension of a URL...

CVE-2006-0816: Undefined Security Weakness

Orion Application Server before 2.0.7, when running on Windows, allows remote attackers to obtain the source code of JSP files via 1 . dot and 2 space characters in the extension of a URL...

[SA19306] Quick 'n Easy Web Server ASP Code Disclosure Vulnerability

TITLE: Quick 'n Easy Web Server ASP Code Disclosure Vulnerability SECUNIA ADVISORY ID: SA19306 VERIFY ADVISORY: http://secunia.com/advisories/19306/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Quick and Easy Web Server 3.x...

Orion < 2.0.7 Crafted Filename Extension Source Code Disclosure

Binary data 3486.prm...

CVE-2006-0819

CVE-2006-0819 affects Dwarf HTTP Server 1.3.2. A validation error in the requested URL filename extension (dot/space/slash/NULL characters) allows remote disclosure of JSP source. Secunia also notes unsanitized error responses enabling XSS. Mitigation: update to version 1.3.3.

CVE-2006-0819: Undefined Security Weakness

Dwarf HTTP Server 1.3.2 allows remote attackers to obtain the source code of JSP files via 1 dot, 2 space, 3 slash, or 4 NULL characters in the filename extension of an HTTP request...

Multiple Dwarf HTTP Server vulnerabilities

Crossite scripting, scripts source code disclosure...

CVE-2006-0815

Summary of CVE-2006-0815 : Affects NetworkActiv Web Server 3.5.15. The vulnerability arises from improper validation of filename extensions when a forward slash is included in a URL, enabling a remote attacker to disclose the source code of scripts hosted on the server (information disclosure). I...

CVE-2006-0949

RaidenHTTPD 1.1.47 is vulnerable to information disclosure via crafted requests containing dot, space, and slash characters that allow remote attackers to obtain source code of script files (e.g., PHP). The underlying issue is inadequate validation of URL filename extensions. A fix is to upgrade ...

CVE-2006-0815: Undefined Security Weakness

NetworkActiv Web Server 3.5.15 allows remote attackers to read script source code via a crafted URL with a "/" forward slash after the file extension...

CVE-2006-0949: Undefined Security Weakness

RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving 1 "." dot, 2 space, and 3 "/" slash characters...

CVE-2006-0425: Undefined Security Weakness

BEA WebLogic Portal 8.1 through SP4 allows remote attackers to obtain the source for a deployment descriptor file via unknown vectors...

CVE-2005-4550

The PORTAL schema in Oracle Application Server OracleAS Discussion Forum Portlet allows remote attackers to obtain the source code for arbitrary JSP and other files via a dfnextpage parameter with a trailing null byte %00...

CVE-2005-4550: Undefined Security Weakness

The PORTAL schema in Oracle Application Server OracleAS Discussion Forum Portlet allows remote attackers to obtain the source code for arbitrary JSP and other files via a dfnextpage parameter with a trailing null byte %00...

oracle Application server discussion forum portlet - Multiple Vulnerabilities

oracle Application server discussion forum portlet - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/16048/info Oracle Application Server Discussion Forum Portlet is affected by multiple remote vulnerabilities. The following specific vulnerabilities were identified: The...

oracle Application server discussion forum portlet - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/16048/info Oracle Application Server Discussion Forum Portlet is affected by multiple remote vulnerabilities. The following specific vulnerabilities were identified: The application is prone to a cross-site scripting vulnerability. Discussion Forum Portle...

CVE-2005-4473: Undefined Security Weakness

Unspecified vulnerability in Macromedia JRun 4 web server JWS allows remote attackers to view web application source code via "a malformed URL."...

CVE-2005-4473

Unspecified vulnerability in Macromedia JRun 4 web server JWS allows remote attackers to view web application source code via "a malformed URL."...

lyris-listmanager.txt

Title: Lyris ListManager Multiple Flaws Release Date: December 8, 2005 Patch Date: Unknown v8.9b resolves most issues Reported Date: June 21, 2005 Vendor: Lyris Systems Affected: Lyris ListManager v5.0-8.8a most flaws Summary: The Lyris ListManager software is vulnerable to numerous SQL injection...

CVE-2005-4147

The TCLHTTPd component of Lyris ListManager (pre-8.9b) is vulnerable: remote attackers can obtain source code for arbitrary .tml TCL files via a request containing a trailing null byte (%00), with a possible authentication bypass involving a username ending in “@”. Affected product/version: ListM...