sawmill-5.0.21.txt

Version: Sawmill 5.0.21 Vendor: Notified. Link: http://www.flowerfire.com/sawmill [email protected] http://vapid.betteros.org SawMill is a site log statistics package for UNIX, Windows and MacOS. I have been evaluating it under Linux. In my test configuration I have sawmill listening on port...

Flowerfire Sawmill 5.0.21 - File Access

Flowerfire Sawmill 5.0.21 - File Access source: https://www.securityfocus.com/bid/1402/info Sawmill is a site statistics package for Unix, Windows and Mac OS. A specially crafted request can disclose the first line of any world readable file for which the full pathname is known, for example...

CVE-2000-0330

The networking software in Windows 95 and Windows 98 allows remote attackers to execute commands via a long file name string, aka the "File Access URL" vulnerability...

ssibug

ssi server sides include is a cgi proggie that comes by default with thttpd web server, I am not sure about others. ssi has a nasty bug with regards to the PATHTRANSLATED env var. As you can see the contents of PATHTRANSLATED get copied into pathtranslated which get's fopen'ed later. It does no...

(без имени)

Hi Bugtraq people, This is a a copy of the mail I send to AVM about the Securtity Bugs in Ken! ISDN Proxy Software. eAX --------------------------------------------------------------- Dear AVM Team, I found two serious security bugs in your internet/isdn proxy software AVM Ken!, and I think I...

Security bug in Apache project: Jakarta Tomcat

The Apache project: Jakarta Tomcat contains a serius security bug. Tomcat is used together with the Apache web server to serve Java Server Pages and Java servlets. Summary from the Tomcat development team advisory is posted below: Advisory: Delivered with Tomcat is an example jsp/source.jsp that...

Generation Terrorists Designs & Concepts Sojourn 2.0 - File Access

source: https://www.securityfocus.com/bid/1052/info Any file that the webserver has read access to can be read on a server running the Sojourn search engine. The Sojourn software includes the ability to organize a website into categories. These categories can then be accessed via the sojourn.cgi...

altavista.txt

hola, more bugs in the AV-Search thing .. using uri-encoded strings it is possible to view "any" file on the system .. examples: unixxxsss ... http://server:port/cgi-bin/query?mss=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd or on an micro$oft IIS...

CVE-1999-0871

Internet Explorer 4.0 and 4.01 allow a remote attacker to read files via IE's cross frame security, aka the "Cross Frame Navigate" vulnerability...

Sun NetBeans Java IDE HTTP Server IP Restriction Bypass Arbitrary File/Directory Access (deprecated)

The remote host is running NetBeans recently renamed to 'Forte' Java IDE. There is a bug in this version that allows anyone to browse the files on this system. This plugin has been deprecated. Webmirror3 plugin ID 10662 will identify a browsable directory. %NASLMINLEVEL 999999 C Tenable Network...

CVE-2000-0330

The networking software in Windows 95 and Windows 98 allows remote attackers to execute commands via a long file name string, aka the "File Access URL" vulnerability...

CVE-2000-0355

pg and pb in SuSE pbpg 1.x package allows an attacker to read arbitrary files...

exlibris.alpeh.webserver.txt

Date: Fri, 21 May 1999 12:08:00 +0200 From: Jakub Urbanec To: [email protected] Subject: ExLibris Aleph Web server Security Alert We have found a security hole in web server bundled with Aleph librarian system ver. 3.25 and higher ExLibris. The web server in its default configuration allows...

cfusion.txt

L0pht Security Advisory ------------- URL Origin: http://www.l0pht.com/advisories.html Release Date: April 20th, 1999 Application: Cold Fusion Application Server Severity: Web users can download, delete and even upload executable files to a Cold Fusion server. Access is not limited to files under...

alibaba.2.0.txt

Date: Thu, 6 May 1999 23:51:27 +0200 From: Arne Vidstrom To: [email protected] Subject: ".."-hole in Alibaba 2.0 Hi, I've found a security hole in the web server Alibaba 2.0 the latest version. I haven't tried it on any other version. Here's an example: If you install it so the web...

ms.personal.webserver.txt

Date: Sat, 27 Mar 1999 11:29:56 -0800 From: [email protected] To: [email protected] Subject: Microsoft Security Bulletin MS99-010 The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an...

Compaq Client Management Agents 3.704.0 Insight Management Agents 4.21 A4.22 A4.30 A Intelligent Cluster Administrator 1.0 Management Agents for Workstations 4.20 A Server Management Agents 4.23 Survey Utility 2.0 - Web File Access

Compaq Client Management Agents 3.704.0 Insight Management Agents 4.21 A4.22 A4.30 A Intelligent Cluster Administrator 1.0 Management Agents for Workstations 4.20 A Server Management Agents 4.23 Survey Utility 2.0 - Web File Access source: https://www.securityfocus.com/bid/282/info A vulnerabilit...

CVE-1999-0776

Alibaba HTTP server allows remote attackers to read files via a .. dot dot attack...

Microsoft IIS 4.0 / Microsoft Site Server 3.0 - Showcode ASP

source: https://www.securityfocus.com/bid/167/info A sample Active Server Page ASP script installed by default on Microsoft's Internet Information Server IIS 4.0 gives remote users access to view any file on the same volume as the web server that is readable by the web server. IIS 4.0 installs a...

Qbik WinGate Standard 3.0.5 - Log Service Directory Traversal

source: https://www.securityfocus.com/bid/507/info The WinGate log service is configured by default to only allow connections from 127.0.0.1, but can be set to allow connections from anywhere. Either way, there is a vulnerability that will allow any file to be read through the log service port ov...