PHP-Nuke 6.0 - Multiple Full Path Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/6406/info Multiple path disclosure vulnerabilities have been discovered in PHP-Nuke. This issue occurs when requesting a PHP script that shouldn't be accessed directly. Exploiting this issue will cause the target server to disclose sensitive information...

Multiple Mambo Site Server sec-weaknesses

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: Multiple Mambo Site Server sec-weaknesses product: Mambo Site Server 4.0.11 vendor: http://sourceforge.org/projects/mambo risk: high date: 12/12/2k2 discovered by: euronymous /F0KP /HACKRU Team advisory urls:...

Mambo Site Server 4.0.11 - Full Path Disclosure

Mambo Site Server 4.0.11 - Full Path Disclosure source: https://www.securityfocus.com/bid/6387/info A vulnerability has been discovered in Mambo Site Server. Requesting the 'index.php' script with an invalid parameter will cause an error page to be generated containing the path of the Mambo scrip...

Mambo Site Server 4.0.11 - Full Path Disclosure

source: https://www.securityfocus.com/bid/6387/info A vulnerability has been discovered in Mambo Site Server. Requesting the 'index.php' script with an invalid parameter will cause an error page to be generated containing the path of the Mambo script. Information obtained by exploiting this issue...

XSS and Path Disclosure in UPB

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: XSS and Path Disclosure in UPB product: Ultimate PHP Board UPB final beta 1.0 vendor: http://www.webrc.ca/php/upb.php risk: middle date: 12/7/2k2 discovered by: euronymous /F0KP /HACKRU Team advisory url: http://f0kp.iplus.ru/bz/009.txt...

CVE-2002-1052

Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to 1 cause a denial of service using the "con" device, or 2 obtain the physical path of the server using two requests to the "aux" device...

Easynews does not adequately validate user input thereby disclosing server installation path via crafted URL request

Overview Easynews does not adequately validate user input. Attackers may exploit this vulnerability to learn the filesystem path where the script is installed. Description Easynews is an open-source CGI script designed to create dynamic news story web pages and listings. Easynews does not properl...

DEBIAN-CVE-2002-0654

Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via 1 a request for a .var file, which leaks the pathname in the resulting error message, or 2 via an error message that occurs when a script child process cannot be invoked...

Mozilla Bonsai 1.3 - Full Path Disclosure

Mozilla Bonsai 1.3 - Full Path Disclosure source: https://www.securityfocus.com/bid/5517/info A path disclosure vulnerability has been reported in Mozilla Bonsai. An attacker can exploit this vulnerability by making a malformed request to Bonsai. This causes Bonsai to return an error page to the...

Mozilla Bonsai 1.3 - Full Path Disclosure

source: https://www.securityfocus.com/bid/5517/info A path disclosure vulnerability has been reported in Mozilla Bonsai. An attacker can exploit this vulnerability by making a malformed request to Bonsai. This causes Bonsai to return an error page to the requesting user. This error page will...

Apache 2.0.39 directory traversal and path disclosure bug

Auriemma Luigi, PivX security advisory AL001 Application: Apache WebServer http://httpd.apache.org Version: 2.0.39 and previous 2.0.x, ONLY on systems that supports backslash path delimiters Win/Netware/OS2 etc... Bug: Directory traversal vulnerability and path disclosure Risk high: An attacker c...

Apache 2.0 - Full Path Disclosure

Apache 2.0 - Full Path Disclosure source: https://www.securityfocus.com/bid/5485/info A path disclosure vulnerability has been reported in Apache 2.0.x. It is possible to reproduce this condition on vulnerable systems by making a request for certain types of files such as error documents that hav...

Apache 2.0 - Full Path Disclosure

source: https://www.securityfocus.com/bid/5485/info A path disclosure vulnerability has been reported in Apache 2.0.x. It is possible to reproduce this condition on vulnerable systems by making a request for certain types of files such as error documents that have been mapped by the server by typ...

CVE-2002-0462

bigsamguestbook.php for Big Sam Built-In Guestbook Stand-Alone Module 1.1.08 and earlier allows remote attackers to cause a denial of service CPU consumption or obtain the absolute path of the web server via a displayBegin parameter with a very large number, which leaks the web path in an error...

KPMG-2002031: Jigsaw Webserver Path Disclosure

-------------------------------------------------------------------- Title: Jigsaw Webserver Path Disclosure BUG-ID: 2002031 Released: 17th Jul 2002 -------------------------------------------------------------------- Problem: ======== It is possible to disclose the physical path to the webroot...

Multiple problems in Jigsaw

DOS-device DoS, path disclosure...

Resin MS-DOS Device Request Path Disclosure

Resin will reveal the physical path of the webroot when asked for a special DOS device, e.g. lpt9.xtp An attacker may use this flaw to gain further knowledge about the remote filesystem layout. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik Anderson...

Apache Web Server ap_log_rerror() function discloses full path to CGI script

Overview There is a vulnerability in Apache 2.0 through 2.035 that could disclose the real path to a CGI script or other file. Description A vulnerability in the Apache web server could disclose sensitive information. Quoting from the Apache Change Log: Security Added the APLOGTOCLIENT flag to...

Bugs in Apache Tomcat

Physical path disclosure, DoS...

CGIscript.net - csNews.cgi - Multiple Vulnerabilities

CGIscript.net - csNews.cgi - Multiple Vulnerabilities --------------------------------------------------------------------- Date : June 11, 2002 Product : csNews.cgi csNews standard csNews.cgi csNews Pro Vendor : WWW.CGIscript.NET, LLC. Homepage : http://www.cgiscript.net/ DISCUSSION:...