aolserver 3.2 Win32 - Directory Traversal

source: https://www.securityfocus.com/bid/2343/info It is possible for a remote user to gain read access to directories outside the root directory of an AOLserver. Requesting a specially crafted URL composed of '.../' sequences will disclose an arbitrary directory. http://target/.../file outside...

Vulnerabilities in BiblioWeb Server

To Ben Greenbaum: Please post this advisory instead of the last. I needed to make a minor change to the 'Vendor Status' section. Thanks. ---------- Vulnerabilities in BiblioWeb Server Overview BiblioWeb Server 2.0 is a web server available from http://www.biblioscape.com. A vulnerability exists...

FreeBSD-SA-01:16.mysql

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:16 Security Advisory FreeBSD, Inc. Topic: mysql may allow remote users to gain increased privileges Category: ports Module: mysql322-server/mysql323-server Announced:...

[SAFER] Security Bulletin 010124.EXP.1.11

S.A.F.E.R. Security Bulletin 010124.EXP.1.11 TITLE : Netscape Enterprise Server - INDEX request problem DATE : January 24, 2001 NATURE : Information gathering AFFECTED : Netscape Enterprise Server 3.x and 4.x with Web Publishing enabled PROBLEM: Problems exists that allows remote user to obtain...

fastream ftp++ 2.0 - Directory Traversal

fastream ftp++ 2.0 - Directory Traversal source: https://www.securityfocus.com/bid/2267/info It is possible for a remote uesr to gain read permissions outside of the Faststream FTP++ Server directory. By requesting an 'ls' command along with the drive name, Fastream FTP++ will disclose the conten...

Lotus Domino Server 5.0.x - Directory Traversal (2)

source: https://www.securityfocus.com/bid/2173/info It is possible for a remote user to gain access to any known file residing on the Lotus Domino Server 5.0.6 and previous. A specially crafted HTTP request comprised of '.nsf' and '../' along with the known filename, will display the contents of...

alex heiphetz Group eZshopper 2.03.0 - Directory Traversal

alex heiphetz Group eZshopper 2.03.0 - Directory Traversal source: https://www.securityfocus.com/bid/2109/info It is possible for a remote user to gain read access to various files that reside within the EZShopper directory. By requesting a specially crafted URL utilizing loadpage.cgi' applicatio...

Apache 1.3 + PHP 3 - File Disclosure

source: https://www.securityfocus.com/bid/2060/info Apache Web Server is subject to disclose files to unauthorized users when used in conjunction with the PHP3 script language. By requesting a specially crafted URL by way of php, it is possible for a remote user to gain read access to a known fil...

Cat Soft Serv-U FTP Server 2.4/2.5 - FTP Directory Traversal

source: https://www.securityfocus.com/bid/2052/info FTP Serv-U is an internet FTP server from CatSoft. Authenticated users can gain access to the ftproot of the drive where Serv-U FTP has been installed. Users that have read, write, execute and list access in the home directory will have the same...

Inktomi Search Software 3.0 - Source Disclosure

Inktomi Search Software 3.0 - Source Disclosure source: https://www.securityfocus.com/bid/2061/info A vulnerability exists in version 3.0 of Ultrseek server aka Inktomi Search. Due to a failure to properly validate user-supplied input, URLs submitted by a remote user of the form:...

anaconda Foundation 1.4 1.9 - Directory Traversal

anaconda Foundation 1.4 1.9 - Directory Traversal source: https://www.securityfocus.com/bid/2338/info A vulnerability exists in Anaconda Foundation Directory which allows a remote user to traverse the filesystem of a target computer. This may lead to the disclosure of file and directory contents...

anaconda Foundation 1.4 < 1.9 - Directory Traversal

source: https://www.securityfocus.com/bid/2338/info A vulnerability exists in Anaconda Foundation Directory which allows a remote user to traverse the filesystem of a target computer. This may lead to the disclosure of file and directory contents. Arbitrary files can be accessed through the use o...

SLA-16.MasterIndex.txt

Synnergy Laboratories Advisory SLA-2000-16 NAME Master Index directory traversal vulnerability AFFECTED Linux/UNIX with Master Index SYNOPSIS Synnergy Labs has found a flaw within Master Index that allows a user to successfully traverse the filesystem on a remote host, allowing arbitary...

SmartWin CyberOffice Shopping Cart 2.0 - Client Information Disclosure

source: https://www.securityfocus.com/bid/1734/info Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000. It is possible for a remote user to gain read access to the private directory on a website running...

nathan purciful phpphotoalbum 0.9.9 - Directory Traversal

source: https://www.securityfocus.com/bid/1650/info The explorer.php script within phpPhotoAlbum 0.9.9 and possibly previous versions are vulnerable to directory traversal. By requesting a URL composed of explorer.php and the ../ string in the value of the "folder" variable it is possible for a...

GWScripts News Publisher 1.0 - author.file Write

GWScripts News Publisher 1.0 - author.file Write source: https://www.securityfocus.com/bid/1621/info It is possible for a remote user to add an author to the author index author.file in GWScripts News Publisher, a web news publisher. This can be done by requesting the following raw HTTP request...

GWScripts News Publisher 1.0 - 'author.file' Write

source: https://www.securityfocus.com/bid/1621/info It is possible for a remote user to add an author to the author index author.file in GWScripts News Publisher, a web news publisher. This can be done by requesting the following raw HTTP request using any arbitrary username and password: POST...

Account Manager CGI Vulnerability

Product: Account Manager Versions: ALL including LITE and PRO haven't been able to test ENTERPRISE OS: Unix and Winnt Vendor: Notified, http://www.cgiscriptcenter.com/ The Problem: The Script allows any remote user access to the Administration Control Panel through overwriting the Admin Password...

Subscribe Me Vulnerability

Product: Subscribe Me Versions: ALL version numbers LITE only OS: Unix and Winnt Vendor: Notified, http://www.cgiscriptcenter.com/ The Problem: Yet again the script allows a remote user to overwrite the Admin Passwd file with any password they see fit. Therefore giving them Admin access to the...

CGI Script Center Subscribe Me Lite 2.0 - Administrative Password Alteration (2)

CGI Script Center Subscribe Me Lite 2.0 - Administrative Password Alteration 2 source: https://www.securityfocus.com/bid/1607/info Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Subscribe Me Lite. This would grant the user full...