4338 matches found
MyABraCaDaWeb 1.0 - Full Path Disclosure
source: https://www.securityfocus.com/bid/7126/info MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This information could be useful in further attacks against a system hosting the software. http://www.example.com/index.php?IDAdmin=tes...
Thunderstone Software TEXIS Nonexistent File Request Path Disclosure
The Thunderstone Software TEXIS application running on the remote host is affected by an information disclosure vulnerability that allows an unauthenticated, remote attacker to obtain the full path of the web root directory by making a specially crafted request for a nonexistent file. %NASLMINLEV...
ColdFusion on IIS cfm/dbm Diagnostic Error Path Disclosure
It was possible to make the remote web server disclose the physical path to its web root by requesting a MS-DOS device ending in .dbm as in nul.dbm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script was written by Renaud Deraison Modified by Paul Johnston for Westpoint Ltd to displ...
Serv-U < 2.5e Multiple Vulnerabilities (OF, Path Disc)
The remote FTP server discloses the full path to its root through a CWD command for a nonexistent directory. In addition, the server may be prone to a buffer overflow that may allow a remote, authenticated attacker to launch a denial of service attack against the affected software. C Tenable...
PHP-Nuke 5.5/6.0 News Module - Full Path Disclosure
source: https://www.securityfocus.com/bid/7079/info The News module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the information gathered in this manner to mount further attacks...
PHP-Nuke 5.56.0 AvantGo Module - Full Path Disclosure
PHP-Nuke 5.56.0 AvantGo Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7078/info The AvantGo module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the...
PHP-Nuke 5.5/6.0 AvantGo Module - Full Path Disclosure
source: https://www.securityfocus.com/bid/7078/info The AvantGo module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the information gathered in this manner to mount further attacks...
PHP-Nuke Splatt Forum 3.2 Module - Full Path Disclosure
PHP-Nuke Splatt Forum 3.2 Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7080/info The Splatt Forum module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker could use the...
PHP-Nuke 5.56.0 News Module - Full Path Disclosure
PHP-Nuke 5.56.0 News Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7079/info The News module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the information...
PHP-Nuke Splatt Forum 3.2 Module - Full Path Disclosure
source: https://www.securityfocus.com/bid/7080/info The Splatt Forum module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker could use the information gathered in this manner to mount further...
typo3 issues
hola, ... [email protected]/Martin Eiszner ===================== Security REPORT TYPO3 ===================== this document: http://www.websec.org/adv/typo3.html Product: Typo3 Version 3.5b5 / Earlier versions are possibly vulnerable too Vendor: Typo3 http://www.typo3.com Vendor-Status:...
typo3 issues
hola, ... [email protected]/Martin Eiszner ===================== Security REPORT TYPO3 ===================== this document: http://www.websec.org/adv/typo3.html Product: Typo3 Version 3.5b5 / Earlier versions are possibly vulnerable too Vendor: Typo3 http://www.typo3.com Vendor-Status:...
Apple QuickTime/Darwin Streaming Server Multiple Remote Vulnerabilities
The remote host is running Apple QuickTime Streaming Server. There are multiple flaws in this version : Remote code execution vulnerability by default with root privileges 2 Cross-Site Scripting vulnerabilities Path Disclosure vulnerability Arbitrary Directory listing vulnerability Buffer overflo...
XSS and Path Disclosure in Sage
=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: XSS and Path Disclosure in Sage product: Sage 1.0b3 vendor: http://sage.dev.box.sk/ risk: middle date: 02/20/2k3 discovered by: euronymous /f0kp /r00tc0de advisory urls: http://f0kp.iplus.ru/bz/015.en.txt http://f0kp.iplus.ru/bz/015.ru.txt...
Sage 1.0 Beta 3 - Content Management System Full Path Disclosure
Sage 1.0 Beta 3 - Content Management System Full Path Disclosure source: https://www.securityfocus.com/bid/6893/info Sage Content Management System contains a path disclosure vulnerability. When a request is made for a module that does not exist, the returned error message contains the full path ...
XSS and Path Disclosure in Sage
=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: XSS and Path Disclosure in Sage product: Sage 1.0b3 vendor: http://sage.dev.box.sk/ risk: middle date: 02/20/2k3 discovered by: euronymous /f0kp /r00tc0de advisory urls: http://f0kp.iplus.ru/bz/015.en.txt http://f0kp.iplus.ru/bz/015.ru.txt...
Sage 1.0 Beta 3 - Content Management System Full Path Disclosure
source: https://www.securityfocus.com/bid/6893/info Sage Content Management System contains a path disclosure vulnerability. When a request is made for a module that does not exist, the returned error message contains the full path to the Sage installation directory. Disclosed path information...
Zope Malformed XML RPC Request Path Disclosure
There is a minor security problem in all releases of Zope prior to version 2.5.1b1 - they reveal the installation path when an invalid XML RPC request is sent. C Tenable Network Security, Inc. http://collector.zope.org/Zope/359 include"compat.inc"; ifdescription scriptid11234; scriptversion "1.19...
Oracle 9iAS Nonexistent .jsp File Request Error Message Path Disclosure
Oracle 9iAS allows remote attackers to obtain the physical path of a file under the server root via a request for a nonexistent .JSP file. The default error generated leaks the pathname in an error message. %NASLMINLEVEL 70300 This script was written by Javier Fernandez-Sanguino This software is...
TOPo 1.43 and prior - Path Disclosure (in.php, out.php)
Poduct: TOPo. TOPo is a free TOP system written in PHP that works without MySQL database. TOPo is specially designed for web sites hosted in web servers that not offer a quality MySQL support. More info: http://ej3scripts.loadedweb.com/modules.php?name=InfoScripts&file=index&func=topo + Web Site:...