CVE-2002-1052: Undefined Security Weakness

Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to 1 cause a denial of service using the "con" device, or 2 obtain the physical path of the server using two requests to the "aux" device...

Mozilla Bonsai 1.3 - Full Path Disclosure

Mozilla Bonsai 1.3 - Full Path Disclosure source: https://www.securityfocus.com/bid/5517/info A path disclosure vulnerability has been reported in Mozilla Bonsai. An attacker can exploit this vulnerability by making a malformed request to Bonsai. This causes Bonsai to return an error page to the...

Mozilla Bonsai 1.3 - Full Path Disclosure

source: https://www.securityfocus.com/bid/5517/info A path disclosure vulnerability has been reported in Mozilla Bonsai. An attacker can exploit this vulnerability by making a malformed request to Bonsai. This causes Bonsai to return an error page to the requesting user. This error page will...

Apache 2.0.39 directory traversal and path disclosure bug

Auriemma Luigi, PivX security advisory AL001 Application: Apache WebServer http://httpd.apache.org Version: 2.0.39 and previous 2.0.x, ONLY on systems that supports backslash path delimiters Win/Netware/OS2 etc... Bug: Directory traversal vulnerability and path disclosure Risk high: An attacker c...

Apache 2.0 - Full Path Disclosure

Apache 2.0 - Full Path Disclosure source: https://www.securityfocus.com/bid/5485/info A path disclosure vulnerability has been reported in Apache 2.0.x. It is possible to reproduce this condition on vulnerable systems by making a request for certain types of files such as error documents that hav...

Apache 2.0 - Full Path Disclosure

source: https://www.securityfocus.com/bid/5485/info A path disclosure vulnerability has been reported in Apache 2.0.x. It is possible to reproduce this condition on vulnerable systems by making a request for certain types of files such as error documents that have been mapped by the server by typ...

CVE-2002-0462

bigsamguestbook.php for Big Sam Built-In Guestbook Stand-Alone Module 1.1.08 and earlier allows remote attackers to cause a denial of service CPU consumption or obtain the absolute path of the web server via a displayBegin parameter with a very large number, which leaks the web path in an error...

KPMG-2002031: Jigsaw Webserver Path Disclosure

-------------------------------------------------------------------- Title: Jigsaw Webserver Path Disclosure BUG-ID: 2002031 Released: 17th Jul 2002 -------------------------------------------------------------------- Problem: ======== It is possible to disclose the physical path to the webroot...

Multiple problems in Jigsaw

DOS-device DoS, path disclosure...

Resin MS-DOS Device Request Path Disclosure

Resin will reveal the physical path of the webroot when asked for a special DOS device, e.g. lpt9.xtp An attacker may use this flaw to gain further knowledge about the remote filesystem layout. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik Anderson...

Apache Web Server ap_log_rerror() function discloses full path to CGI script

Overview There is a vulnerability in Apache 2.0 through 2.035 that could disclose the real path to a CGI script or other file. Description A vulnerability in the Apache web server could disclose sensitive information. Quoting from the Apache Change Log: Security Added the APLOGTOCLIENT flag to...

CVE-2001-0917: Undefined Security Weakness

Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension...

Bugs in Apache Tomcat

Physical path disclosure, DoS...

CGIscript.net - csNews.cgi - Multiple Vulnerabilities

CGIscript.net - csNews.cgi - Multiple Vulnerabilities --------------------------------------------------------------------- Date : June 11, 2002 Product : csNews.cgi csNews standard csNews.cgi csNews Pro Vendor : WWW.CGIscript.NET, LLC. Homepage : http://www.cgiscript.net/ DISCUSSION:...

CVE-2002-0596

CVE-2002-0596 affects WebTrends Reporting Center 4.0d. A remote attacker can cause an error message to disclose the server’s real path by issuing a GET to get_od_toc.pl with an empty Profile parameter, resulting in information disclosure (pathname leakage). Root cause is an error message that rev...

CVE-2002-0596

WebTrends Reporting Center 4.0d allows remote attackers to determine the real path of the web server via a GET request to getodtoc.pl with an empty Profile parameter, which leaks the pathname in an error message...

CVE-2002-0483

CVE-2002-0483 affects PHP-Nuke versions 5.4 and earlier, where requesting index.php with the file parameter set to index.php can trigger an error message that leaks the web server’s physical pathname. This is a remote vulnerability that primarily exposes confidential information (the server path)...

CVE-2002-0446: Undefined Security Weakness

categorie.php3 in Black Tie Project BTP 0.4b through 0.5b allows remote attackers to determine the absolute path of the web server via an invalid category ID cid parameter, which leaks the pathname in an error message...

Apache on Windows php.exe Malformed Request Path Disclosure

The version of Apache running on the remote Windows host will reveal the physical path of the PHP cgi binary when sent a specially crafted HTTP GET request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11008;...

Security holes : Rose, EasyNews, User Online, Mon Album, KorWebLog

Hello people : Product 1 : Rose http://www.jinxm.co.uk Version : 4.52 Problem : - Admin access Exploit : - newsadmin/upload.php?userinfousername=hop&userinfouserlevel=100 Product 2 : EasyNews http://www.webrc.ca Version : 4.3 Problem : - Admin access Exploits : - admin.php?enlogid=0&action=users ...