Authentication flaw

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services IIS Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile...

CVE-2007-2815

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services IIS Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile...

TFTP Server TFTPDWin 0.4.2 - Directory Traversal

source: https://www.securityfocus.com/bid/23937/info TFTP Server TFTPDWIN is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting this issue allows an attacker to gain read/write access to privileged directories and files. TFT...

tomcat DoS

Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service CPU consumption via a large number of simultaneous requests to list a web directory that has a large number of files...

Unfixed XSS vulnerability at www.aasingapore.com

Security researcher frosTMaturidi, has submitted on 05/07/2007 a cross-site-scripting XSS vulnerability affecting www.aasingapore.com, which at the time of submission ranked 1065314 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/07/2007. It...

Bradford CampusManager v3.1(6) Sensitive Data Disclosure

Bradford CampusManager v3.16 Sensitive Data Disclosure The following directories should be protected from world readability. Child folders include backup, log, and configuration files. http://cmnms.target.com:8080/runTime/ http://cmnms.target.com:8080/remediationReports/ Vulnerable: CampusManager...

HPSBPI01007 SSRT4700 rev.3 - HP Web Jetadmin, Remote Unauthorized Access to Files, Denial of Service (DoS)

Potential Security Impact Remote unauthorized access to files, Denial of Service DoS VULNERABILITY SUMMARY A potential vulnerability has been identified with HP Web Jetadmin. The vulnerability could be exploited to allow remote unauthorized access to files or to create a Denial of Service DoS...

CVE-2007-2035

Cisco Wireless Control System WCS before 4.0.66.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain network organization data via a direct request for files in certain directories, aka Bug ID CSCsg04301...

Improper access control

Cisco Wireless Control System WCS before 4.0.66.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain network organization data via a direct request for files in certain directories, aka Bug ID CSCsg04301...

CVE-2007-1741

Multiple race conditions in suexec in Apache HTTP Server httpd 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that th...

CVE-2007-2012

Multiple directory traversal vulnerabilities in MimarSinan CompreXX 4.1 allow remote attackers to create files in arbitrary directories via a .. dot dot in a 1 .rar, 2 .jar or 3 .zip archive...

CVE-2007-2012

Multiple directory traversal vulnerabilities in MimarSinan CompreXX 4.1 allow remote attackers to create files in arbitrary directories via a .. dot dot in a 1 .rar, 2 .jar or 3 .zip archive...

CVE-2007-1874

Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the 1 CFMX7DreamWeaverExtensions.mxp, 2 CFReportBuilderInstaller.exe, 3 .com.zerog.registry.xml, 4...

Directory traversal

Multiple directory traversal vulnerabilities in ArchiveXpert 2.02 build 80 allow remote attackers to create files in arbitrary directories via a .. dot dot in a 1 .gz, 2 .jar, 3 .rar, 4 .tar.gz, 5 .zip, or 6 .tar file...

CVE-2007-1954

Multiple directory traversal vulnerabilities in ArchiveXpert 2.02 build 80 allow remote attackers to create files in arbitrary directories via a .. dot dot in a 1 .gz, 2 .jar, 3 .rar, 4 .tar.gz, 5 .zip, or 6 .tar file...

CVE-2007-1954

CVE-2007-1954 relates to multiple directory traversal vulnerabilities in ArchiveXpert 2.02 build 80 . The issue allows remote attackers to create files in arbitrary directories by supplying a path with a leading “..” inside archive formats (including .gz, .jar, .rar, .tar.gz, .zip, and .tar). The...

CVE-2007-1954

Multiple directory traversal vulnerabilities in ArchiveXpert 2.02 build 80 allow remote attackers to create files in arbitrary directories via a .. dot dot in a 1 .gz, 2 .jar, 3 .rar, 4 .tar.gz, 5 .zip, or 6 .tar file...

Directory traversal

Directory traversal vulnerability in classes/captcha/captcha.jpg.php in Drake CMS allows remote attackers to read arbitrary files or list arbitrary directories, and obtain the installation path, via a .. dot dot in the dprivate parameter. NOTE: Drake CMS has only a beta version available, and the...

Directory traversal

Multiple directory traversal vulnerabilities in aBitWhizzy allow remote attackers to list arbitrary directories via a .. dot dot in the d parameter to 1 whizzery/whizzypic.php or 2 whizzery/whizzylink.php, different vectors than CVE-2006-6384...

CVE-2007-1773

Multiple directory traversal vulnerabilities in aBitWhizzy allow remote attackers to list arbitrary directories via a .. dot dot in the d parameter to 1 whizzery/whizzypic.php or 2 whizzery/whizzylink.php, different vectors than CVE-2006-6384...