mod_cluster registers and exposes the root context of a server by default, despite ROOT being in the excluded-contexts list

modcluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed...

DEBIAN-CVE-2011-1498

Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header...

Debian Security Advisory DSA 1176-1 (zope2.7)

The remote host is missing an update to zope2.7 announced via advisory DSA 1176-1. It was discovered that the Zope web application server does not disable the csvtable directive in web pages containing ReST markup, allowing the exposure of files readable by the Zope server. OpenVAS Vulnerability...

CISADV000524b.txt

Cerberus Information Security Advisory CISADV000524b http://www.cerberus-infosec.co.uk/advisories.shtml Released : 24th May 2000 Name : Carello Web file overwriting vulnerability Affected Systems : Windows NT running IIS Issue : Remote attackers can write to a server and view source of .asp files...