3081 matches found
BEA WebLogic < 5.1 SP 11 JSP Source Disclosure
Binary data 1538.prm...
CVE-2004-0280
Caucho Technology Resin 2.1.12 allows remote attackers to view JSP source via an HTTP request to a .jsp file that ends in a "%20" encoded space character, e.g. index.jsp%20...
CVE-2004-0280
CVE-2004-0280 affects Caucho Technology Resin 2.1.12, where an attacker can remotely view JSP source by issuing an HTTP request to a .jsp file that ends with an encoded space (for example index.jsp%20). The underlying issue allows partial disclosure of source content, as reflected in the CVSS-bas...
Cross Site Scripting in WebzEdit
Title:Cross Site Scripting in WebzEdit Release Date: Feb 22,2004 Application: WebzEdit Version Affected: 1.9 or lower Platform: JSP Severity: Low Discover: Cheng Peng Suapplesoupatmsn.com Vendor URL: http://www.freewebs.com/ Intro: WebzEdit is a tool to edit web page online. Proof Of Concept: Thi...
CVE-2003-0411
Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase .jsp extension...
jboss .jsp source code leakage
By adding 00 то URL it's possible to obtain source code of .jsp page...
CVE-2003-0411
CVE-2003-0411 affects Sun ONE Application Server 7.0 on Windows 2000/XP. A remote attacker can obtain JSP source code by requesting a file with the uppercase extension ".JSP" instead of ".jsp". The provided documents do not specify a patch version or remediation; exploitation details are not desc...
CVE-2003-0411
Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase .jsp extension...
PT-2003-1602 · Sun · Sun One Application Server
Name of the Vulnerable Software and Affected Versions: Sun ONE Application Server version 7.0 Description: The issue allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase .jsp extension. Recommendations: For Sun ONE...
JBoss %00 Request JSP Source Disclosure
It is possible to make the remote web server disclose the source code of its JSP pages by appending a NULL character to the name of the JSP files requested eg, 'foo.jsp%00'. An attacker may use this flaw to get the source code of scripts on the remote host and possibly obtain passwords and other...
JBoss.txt
Hi, jboss 3.2.1 with jetty seems to be vulnerable to jsp source code disclosure. Trying to access the ServerInfo.jsp with an suffixed "%00" shows the source code of this JSP. Seems to be a forgotten debug feature :- http://192.168.0.4:8080/web-console/ServerInfo.jsp%00 Sincerely Marc Schoenefeld...
JBOSS 3.2.1: JSP source code disclosure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, jboss 3.2.1 with jetty seems to be vulnerable to jsp source code disclosure. Trying to access the ServerInfo.jsp with an suffixed "00" shows the source code of this JSP. Seems to be a forgotten debug feature :-...
Sun ONE Application Server Upper Case Request JSP Source Disclosure
It is possible to make the remote web server disclose the source code of its JSP pages by requesting the pages with a different case ie: filename.JSP instead of filename.jsp. An attacker may use this flaw to get the source code of your CGIs and possibly obtain passwords and other relevant...
sunone.txt
Multiple Vulnerabilities in Sun-One Application Server ------------------------------------------------------- Release Date: May 27, 2003 System Affected Sun-ONE Application Server 7.0 for Windows 2000/XP Description During a brief audit of a SunONE Application Server installation on Windows 2000...
Multiple Vulnerabilities in Sun-One Application Server
Multiple Vulnerabilities in Sun-One Application Server ------------------------------------------------------- Release Date: May 27, 2003 System Affected Sun-ONE Application Server 7.0 for Windows 2000/XP Description During a brief audit of a SunONE Application Server installation on Windows 2000...
BEA WebLogic SSIServlet Invocation Source Code Disclosure
BEA WebLogic may be tricked into revealing the source code of JSP scripts by prefixing the path to the .jsp files by /.shtml/ %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script is based on BEAweblogicRevealsourcecode.nasl Script audit and contributions from Carmichael Security Erik...
Important: Red Hat Security Advisory: tomcat security update for Stronghold
Updated tomcat packages are now available for Stronghold 4.0 to close a second JSP source code exposure vulnerability. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. A source code exposure vulnerability...
CVE-2002-1025
CVE-2002-1025 involves JRun 3.0–4.0. According to the description, remote attackers can read JSP source code by sending an encoded null byte in an HTTP GET request, causing the server to send the .JSP unparsed. The impact is partial confidentiality (read access) with no integrity/availability imp...
CVE-2001-1372
Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message...