WebTrends Reporting Center

NGSSoftware Insight Security Research Advisory Name: WebTrends Reporting Center 4.0d Systems Affected: WinNT, Win2K, XP Severity: High Risk Category: Remote System Buffer Overrun Vendor URL: http://www.webtrends.com Author: Mark Litchfield [email protected] Advisory URL:...

KPMG-2002013: Coldfusion Path Disclosure

-------------------------------------------------------------------- Title: Coldfusion Path Disclosure BUG-ID: 2002013 Released: 18th Apr 2002 -------------------------------------------------------------------- Problem: ======== Requests for certain DOS-devices are parsed by the isapi filter tha...

Security holes : Linker, Pharao

Product1 : Linker http://enproject.codelib.co.kr Versions : 2.0 Problems : - Reading in HD - Informations recovery passwords, DBHOST, DBUSER,... Exploits : - /imageview.php?uid=../function/passinfo.php or /imageview.php?uid=../function/baseinfo.php - Set cookies : "adminlogin","1"...

Security holes in ASP-Nuke

Product : ASP-Nuke http://www.asp-nuke.com Versions : RC1, RC2 Problems : RC1 : - By-passing of filters against HTML RC2 : - Access to all accounts - Cross Site Scripting - Path disclosure More details : in french : http://www.ifrance.com/kitetoua/tuto/ASPNuke.txt translated by Google :...

Security holes in Powerboard forum

Product : Powerboards http://powerboards.sourceforge.net/ Versions : 2.2b and less ? Problems : - Cross Site Scripting - Path disclosure - Access to the administration - Access to users accounts without password - Recovery of admins/users passwords - Suppression of messages - Writing on the hard...

Security bugs in PhpNuke

Hello, I found 2 security bugs in phpnuke The first is a path disclosure vulnerability : Change this http://nukesite.xxx/modules.php?op=modload&name=WebLinks&file=index&lop=viewlink&cid=3 in that ... http://nukesite.xxx/modules.php?op=modload&name=WebLinks&file=index&lop=viewlink The second one i...

[ARL02-A07] ARSC Really Simple Chat System Information Path Disclosure Vulnerability

+/--------------- ALPER Research Labs -----/--------/+ +/--------------- Security Advisory ----/---------/+ +/--------------- ID: ARL02-A07 ---/----------/+ +/--------------- [email protected] --/-----------/+ Advisory Information -------------------- Name : ARSC Really Simple Chat System...

[ARL02-A11] Big Sam (Built-In Guestbook Stand-Alone Module) Multiple Vulnerabilities

+/---------------- ALPER Research Labs ------/--------/+ +/---------------- Security Advisory -----/---------/+ +/---------------- ID: ARL02-A11 ----/----------/+ +/---------------- [email protected] ---/-----------/+ Advisory Information -------------------- Name : Big Sam Built-In Guestbook...

X_holes

Products : xstat v2.3 and less xnews v1.1 Website : http://www.xqus.com/ problems : xstat : - Recovery of numerous data about the computer phpinfo . - Cross Site Scripting - Path disclosure xnews : - Access to the admin menu More details in french : http://www.ifrance.com/kitetoua/tuto/xholes.txt...

[ARL02-A06] Black Tie Project System Information Path Disclosure Vulnerability

+/--------------- ALPER Research Labs -----/--------/+ +/--------------- Security Advisory ----/---------/+ +/--------------- ID: ARL02-A06 ---/----------/+ +/--------------- [email protected] --/-----------/+ Advisory Information -------------------- Name : Black Tie Project System Information...

phpnukeEKO.txt

// PHP Nuke 5.X ? Path disclosure vuln through modules.php by Patryk K. echo7 // // [email protected] http://nyshock.hypermart.net // // efnet dna // PHP Nuke can expose full Path beginning with root dir Which can be used to plan further attack against a Vulnerable website, Disposing Information...

[ARL02-A05] PHP FirstPost System Information Path Disclosure Vulnerability

+/--------------- ALPER Research Labs -----/--------/+ +/--------------- Security Advisory ----/---------/+ +/--------------- ID: ARL02-A05 ---/----------/+ +/--------------- [email protected] --/-----------/+ Advisory Information -------------------- Name : PHP FirstPost System Information Path...

Pi3Web/2.0.0 File-Disclosure/Path Disclosure vuln

Pi3Web/2.0.0 File-Disclosure/Path Disclosure Vulnerability Discovered by: Teknophreak of Malloc Date: March 9 2002 Contact: [email protected] Pi3Web is a Webserver available for multiple Microsoft Windows platforms. There are multiple disclosure flaws within the webserver that may assist an...

CVE-2001-0760

Citrix Nfuse 1.51 allows remote attackers to obtain the absolute path of the web root via a malformed request to launch.asp that does not provide the session field...

Oracle 9i Application Server does not adequately handle requests for nonexistent JSP files thereby disclosing web folder path information

Overview Oracle 9i Application Servers Oracle 9iAS contain a default error page that can be used to find the physical path of files on the system. Description Oracle 9iAS will display a default error page when a nonexistent ".jsp" file is specified. In the body of this page is the entire local pa...

[ARL02-A02] DCP-Portal Root Path Disclosure Vulnerability

+/--------------- ALPER Research Labs -----/--------/+ +/--------------- Security Advisory ----/---------/+ +/--------------- ID: ARL02-A02 ---/----------/+ +/--------------- [email protected] --/-----------/+ Advisory Information -------------------- Name : DCP-Portal Root Path Disclosure...

texis(CGI) Path Disclosure Vulnerability

Advisory: texisCGI Path Disclosure Vulnerability Application: Thunderstone's texisCGI Release Date: 02.05.02 Severity: Any user can send an invalid path to texisCGI causing it to reveal the full path to the webroot. In some cases texis will display system specific informationOS, processor type...

Thunderstone TEXIS 3.0 - Full Path Disclosure

source: https://www.securityfocus.com/bid/4035/info A vulnerability in TEXIS allows an attacker to view the full path to the web root. If the attacker submits an HTTP request for an invalid path, the server will return an error page containing the path to the web root. System information may also...

Mrtg Path Disclosure Vulnerability (Revised)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 /This is Mrtg Web Frontend 14all.cgi bug. You may find the revised security announcement below/ Mrtg/RRD 14all.cgi Path Disclosure Vulnerability Type: Input Validation Error Release Date: February 4, 2002 Product / Vendor: 14all.cgi is a CGI script to...

Thunderstone TEXIS 3.0 - Full Path Disclosure

Thunderstone TEXIS 3.0 - Full Path Disclosure source: https://www.securityfocus.com/bid/4035/info A vulnerability in TEXIS allows an attacker to view the full path to the web root. If the attacker submits an HTTP request for an invalid path, the server will return an error page containing the pat...