Three BadBlue Vulnerabilities

Advisory: Working Resources BadBlue Multiple Vulnerabilities Issue: Three vulnerabilities; a denial of service, an insecurity in password storage, and a file disclosure vulnerability that could allow viewing of the password file. Risk: Critical SecurityFocus: "Working Resources BadBlue Invalid Ge...

iPlanet Web Server 4.1 - Search Component File Disclosure

source: https://www.securityfocus.com/bid/5191/info The iPlanet Web Server search engine is prone to a file disclosure vulnerability. It is possible for remote attackers to make requests to the search engine which will cause arbitrary readable files on the host running the vulnerable software to ...

iPlanet Web Server 4.1 - Search Component File Disclosure

iPlanet Web Server 4.1 - Search Component File Disclosure source: https://www.securityfocus.com/bid/5191/info The iPlanet Web Server search engine is prone to a file disclosure vulnerability. It is possible for remote attackers to make requests to the search engine which will cause arbitrary...

Wolfram Research webMathematica 4.0 - File Disclosure

Wolfram Research webMathematica 4.0 - File Disclosure source: https://www.securityfocus.com/bid/5035/info Wolfram Research's webMathematica is a Java based product which allows the inclusion of Mathematica content in a web environment. It includes CGI programs which generate image content based o...

Wolfram Research webMathematica 4.0 - File Disclosure

source: https://www.securityfocus.com/bid/5035/info Wolfram Research's webMathematica is a Java based product which allows the inclusion of Mathematica content in a web environment. It includes CGI programs which generate image content based on user supplied input. A file disclosure vulnerability...

My Postcards 6.0 - 'MagicCard.cgi' Arbitrary File Disclosure

source: https://www.securityfocus.com/bid/5029/info My Postcards is a commercial available eletronic postcard system. It is available for Unix and Linux Operating Systems. The magiccard.cgi script does not properly handle some types of input. As a result, it may be possible for a remote user to...

My Postcards 6.0 - MagicCard.cgi Arbitrary File Disclosure

My Postcards 6.0 - MagicCard.cgi Arbitrary File Disclosure source: https://www.securityfocus.com/bid/5029/info My Postcards is a commercial available eletronic postcard system. It is available for Unix and Linux Operating Systems. The magiccard.cgi script does not properly handle some types of...

Working Resources 1.7.3 BadBlue - Null Byte File Disclosure

source: https://www.securityfocus.com/bid/5226/info BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems. It has been discovered that a request passed to a BadBlue server containing a null byte at the end of a file nam...

Working Resources 1.7.3 BadBlue - Null Byte File Disclosure

Working Resources 1.7.3 BadBlue - Null Byte File Disclosure source: https://www.securityfocus.com/bid/5226/info BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems. It has been discovered that a request passed to a...

CVE-2002-0410

CVE-2002-0410 (AeroMail) affects AeroMail before 1.45. The vulnerability is in send_message.php, allowing remote attackers to read arbitrary server files instead of only uploaded ones by crafting the attachment filename during upload. This is caused by improper handling of file path/filename duri...

Seanox DevWex Windows Binary 1.2002.520 - File Disclosure

Seanox DevWex Windows Binary 1.2002.520 - File Disclosure source: https://www.securityfocus.com/bid/4978/info The Seanox DevWex Windows binary version is prone to an issue which may cause arbitrary web-readable files to be disclosed to remote attackers. This problem occurs because DevWex does not...

Seanox DevWex Windows Binary 1.2002.520 - File Disclosure

source: https://www.securityfocus.com/bid/4978/info The Seanox DevWex Windows binary version is prone to an issue which may cause arbitrary web-readable files to be disclosed to remote attackers. This problem occurs because DevWex does not sufficiently filter '..' sequences from web requests. GET...

QNX RTOS 4.25 - CRTTrap File Disclosure

QNX RTOS 4.25 - CRTTrap File Disclosure source: https://www.securityfocus.com/bid/4901/info The QNX RTOS crttrap binary includes a command-line option for specifying a configuration file. crttrap is installed setuid by default. crttrap Local attackers may specify an arbitrary system file in place...

QNX RTOS 4.25 - 'CRTTrap' File Disclosure

source: https://www.securityfocus.com/bid/4901/info The QNX RTOS crttrap binary includes a command-line option for specifying a configuration file. crttrap is installed setuid by default. crttrap Local attackers may specify an arbitrary system file in place of the configuration file and crttrap...

Gafware CFXImage 1.6.41.6.6 - ShowTemp File Disclosure

Gafware CFXImage 1.6.41.6.6 - ShowTemp File Disclosure source: https://www.securityfocus.com/bid/4882/info Gafware's CFXImage is a custom tag for ColdFusion. A program included with the CFXImage documentation doesn't properly filter its input. It is reported that a flaw exists in this program tha...

Gafware CFXImage 1.6.4/1.6.6 - ShowTemp File Disclosure

source: https://www.securityfocus.com/bid/4882/info Gafware's CFXImage is a custom tag for ColdFusion. A program included with the CFXImage documentation doesn't properly filter its input. It is reported that a flaw exists in this program that allows a malicious user to read files outside of the...

Opera 6.0.16.0.2 - Arbitrary File Disclosure

Opera 6.0.16.0.2 - Arbitrary File Disclosure source: https://www.securityfocus.com/bid/4834/info A vulnerability has been reported in Opera 6.01/6.02. The vulnerability is related to handling of the 'file' HTML input-type. It is possible for a server to set the file value, while fooling Opera int...

Opera 6.0.1/6.0.2 - Arbitrary File Disclosure

source: https://www.securityfocus.com/bid/4834/info A vulnerability has been reported in Opera 6.01/6.02. The vulnerability is related to handling of the 'file' HTML input-type. It is possible for a server to set the file value, while fooling Opera into thinking no file has been specified. This i...

[SecurityOffice] LocalWeb2000 Web Server Protected File Access Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---- LocalWeb2000 Web Server Protected File Access Vulnerability ---- - ---- Type File Disclosure - ---- Release Date May 24, 2002 - ---- Product / Vendor LocalWEB2000 is an HTTP server for the Windows suite of operating systems. LocalWEB2000 is...

LocalWEB2000 2.1.0 Standard - File Disclosure

LocalWEB2000 2.1.0 Standard - File Disclosure source: https://www.securityfocus.com/bid/4820/info A vulnerability exists in LocalWEB2000 related to content password protection. It is possible to have LocalWEB2000 treat files as unprotected by requesting them as files within the '.' current...