TinyWeb 1.9

The remote host is running TinyWeb version 1.9 or older. A remote user can issue an HTTP GET request for /cgi-bin/.%00./dddd.html and cause the server consume large amounts of CPU time 88%-92%. OpenVAS Vulnerability Test $Id: tinyweb.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: TinyWeb 1....

Service Detection with 'GET' Request

This plugin performs service detection. SPDX-FileCopyrightText: 2005 Michel Arboi SPDX-FileCopyrightText: New detection methods / pattern / code since 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

HTTP User-Agent Overflow DoS Vulnerability

It was possible to kill the web server by sending an invalid GET request with a too long User-Agent field. SPDX-FileCopyrightText: 2002 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2005-3033

Stack-based buffer overflow in vxWeb 1.1.4 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long HTTP GET request...

Hesk 0.920.93 - Session ID Authentication Bypass

Hesk 0.920.93 - Session ID Authentication Bypass source: https://www.securityfocus.com/bid/14879/info Hesk is prone to an authentication bypass vulnerability. Successful exploitation will grant an attacker administrative access to the application. This can lead to unauthorized access of sensitive...

Sawmill < 7.1.14 GET Request Query String XSS

The version of Sawmill running on the remote web server is affected by a cross-site scripting vulnerability due to improper validation of user-supplied input appended to a GET request. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary scri...

Sawmill < 7.1.14 GET Request Query String XSS

Binary data 3219.prm...

CVE-2005-2678

Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVERNAME variable to bypass security checks and conduct various attacks via a GET request with an http://localhost URI, which makes it appear as if the request is coming from localhost...

CVE-2005-2678

Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVERNAME variable to bypass security checks and conduct various attacks via a GET request with an http://localhost URI, which makes it appear as if the request is coming from localhost...

CVE-2004-2463

CVE-2004-2463 affects ADA Image Server (ImgSvr) 0.4. A buffer overflow in the server allows remote attackers to cause a web server crash (denial of service) or execute arbitrary code via a long GET request. The connected records corroborate the long-GET-triggered overflow as the root issue and th...

CVE-2004-2416

CVE-2004-2416 is a buffer overflow in CCProxy’s Telnet proxy ping command for CCProxy v6.2 and earlier. The stack can be overwritten by sending an overly long address to the ping (p) command, allowing remote code execution on vulnerable Windows systems. Public proof‑of‑concepts and exploits exist...

CVE-2004-2416

Buffer overflow in the logging component of CCProxy allows remote attackers to execute arbitrary code via a long HTTP GET request...

CVE-2004-2323

DotNetNuke formerly IBuySpy Workshop 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and password, via a GET request for source or configuration files such as Web.config...

CVE-2005-2420

flsearch.pl in FtpLocate 2.02 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP GET request...

CVE-2005-2420

CVE-2005-2420 affects FtpLocate 2.02 (flsearch.pl) and allows remote command execution by injecting shell metacharacters through HTTP GET. Connected Nessus plugin NASL confirms a remote file inclusion style input manipulation via the fsite parameter, enabling arbitrary command execution on the af...

Netquery <= 3.1 Multiple Vulnerabilities

The remote host is running Netquery, a suite of network information utilities written in PHP. The version of Netquery on the remote host suffers from multiple flaws : - Remote Code Execution An attacker can execute arbitrary commands through the Ping panel of the 'nquser.php' script provided it's...

CVE-2004-2271

CVE-2004-2271 affects MiniShare webserver versions 1.4.1 and earlier. The vulnerability is a remote buffer overflow in the HTTP request handling, originally demonstrated via a long GET request, which can be exploited to execute arbitrary code. Connected exploits and payloads show that not only GE...

CVE-2004-2271

Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request...

Oracle Reports Server 6.0.8/9.0.x - Unauthorized Report Execution

source: https://www.securityfocus.com/bid/14316/info Oracle Reports Server is susceptible to an unauthorized report execution vulnerability. By placing a report file in a globally accessible location, users can trigger the execution of the report by issuing an HTTP GET request to the affected...

CVE-2004-2221

CVE-2004-2221 describes a buffer overflow in the SoftCart.exe CGI of Mercantec SoftCart 4.00b. The vulnerability allows remote attackers to execute arbitrary code by sending a long parameter in an HTTP GET request. Public references show Metasploit and Exploit-DB demonstrations of an exploit for ...