Information Disclosure

glance is vulnerable to information disclosure. A remote attacker is able to access and retrieve arbitrary files in a dot directory within the web server directory via URIs such as /.git/HEAD or /.got/logs/HEAD...

CVE-2017-16108

gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16162

22lixian is a simple file server. 22lixian is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16214

peiserver is a static file server. peiserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16038

f2e-server 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is compounded by f2e-server requiring elevated privileges to run...

Node.js third-party modules: [serve] Server Directory Traversal

I would like to report a Server Directory Traversal vulnerability in serve. It allows reading local files on the target server. Module module name: serve version: 7.0.1 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...

CVE-2014-10073

The createresponse function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory...

Node.js third-party modules: [mcstatic] Server Directory Traversal

I would like to report a Server Directory Traversal in mcstatic. It allows reading local files on the target server. Module module name: mcstatic version: 0.0.20 npm page: https://www.npmjs.com/package/mcstatic Module Description Static Http server for mocking and stuff Vulnerability Steps To...

Node.js third-party modules: [featurebook] Specification Server Directory Traversal via Crafted Browser Request

Hi, A crafted request can be leveraged to traverse the directory structure of a host using the featurebook server package, and request arbitrary files outside of the specified web root. Module specification Name: featurebook Version: 0.0.32 latest release build Verified conditions Test server:...

Huawei HG255s - Server Directory Traversal Vulnerability

Document Title: =============== Huawei HG255s - Server Directory Traversal Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2100 Video: https://www.youtube.com/watch?v=6XxTh7brPLg Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2099 Release...

Microsoft IIS 5.0 IISAPI Extension Enumerate Root Web Server Directory Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/194/info A GET request that specifies a nonexistent file with an IISAPI-registered extension ie .pl, .idq will cause the IIS server to return an error message that includes the full path of the root web server directory...

KorWeblog 1.6.2 - Remote Directory Listing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11744/info A vulnerability is reported in the KorWeblog software that may allow a remote user to disclose directory listings. The problem presents itself when a malicious user crafts an URI request containing directory...

Avaya IP Office Manager TFTP Server 8.1 - Directory Traversal Vulnerability

No description provided by source. Title : Avaya IP Office Manager TFTP Server Directory Traversal Vulnerability Author : Veerendra G.G from SecPod Technologies www.secpod.com Vendor : http://www.avaya.com/usa/product/ip-office Advisory : http://www.avaya.com/usa/product/ip-office...

specview 2.5 build 853 - Directory Traversal

Luigi Auriemma Application: SpecView http://www.specview.com Versions: = 2.5 build 853 Platforms: Windows Bug: web server directory traversal Exploitation: remote Date: 29 Jun 2012 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 The Code 4 Fix...

Insufficient output sanitizing when generating configuration file.

PMASA-2010-4 Announcement-ID: PMASA-2010-4 Date: 2010-08-20 Summary Insufficient output sanitizing when generating configuration file. Description The setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration...

Free Arcade Script 1.0 Auth Bypass (SQL) / Upload Shell Vulnerabilities

No description provided by source. .--------------------------------------------------------------------------. | Web Application : Free Arcade Script 1.0 | | Homepage : http://www.freearcadescript.net | |--------------------------------------------------------------------------| | Vulnerability ...

Free Arcade Script 1.0 SQL Injection / Shell Upload

.--------------------------------------------------------------------------. | Web Application : Free Arcade Script 1.0 | | Homepage : http://www.freearcadescript.net | |--------------------------------------------------------------------------| | Vulnerability : SQL Injection + Remote PHP file...

Free Arcade Script 1.0 - Authentication Bypass Arbitrary File Upload

Free Arcade Script 1.0 - Authentication Bypass Arbitrary File Upload .--------------------------------------------------------------------------. | Web Application : Free Arcade Script 1.0 | | Homepage : http://www.freearcadescript.net |...

Hidden website back-end management-vulnerability warning-the black bar safety net

A recent search through some of the search terms of information, combined with some of the actual search experience draw some of the Security aspects of thinking: Example: Use GOOGLE's search commands intitle:management intitle:background intext:admin And some very simple Search command, you will...

microworld-traverse.txt

Luigi Auriemma Application: MicroWorld eScan Server aka eScan Management Console http://www.mwti.net Versions: From vendor's website: "The Powerful Management Console of eScan provides options for system administrators to remotely administer a vast network of clients. It also allows them to...