PT-2006-5476 · Microsoft · Windows +2

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to XP SP3 and Server 2003 SP2 Description: The issue allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" character in the filename of the Command Line property,...

CVE-2006-3172

Multiple PHP remote file inclusion vulnerabilities in ContentBuilder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL with a trailing slash / character in the 1 langpath parameter to a cms/plugins/colman/column.inc.php, b cms/plugins/poll/poll.inc.php, c...

CVE-2004-2656

CVE-2004-2656 refers to multiple cross-site scripting (XSS) vulnerabilities in the Slashdot Like Automated Storytelling Homepage (Slash) a.k.a. Slashcode, fixed in R_2_5_0_41. The flaws allow remote attackers to inject arbitrary web script or HTML via the topic parameter in search.pl and the filt...

CVE-2004-2656: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Slashdot Like Automated Storytelling Homepage Slash aka Slashcode before R25041 allow remote attackers to inject arbitrary web script or HTML via 1 the topic parameter in search.pl and 2 the filter parameter in submit.pl...

[ GLSA 200603-23 ] NetHack, Slash'EM, Falcon's Eye: Local privilege escalation

Gentoo Linux Security Advisory GLSA 200603-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

tar archive path traversal issue

The original patch for a GNU tar directory traversal vulnerability CVE-2002-0399 in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/"...

DEBIAN-CVE-2005-1918

The original patch for a GNU tar directory traversal vulnerability CVE-2002-0399 in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/"...

URL Buffer Overflow

libcurl's URL parser function can overflow a heap based buffer in two ways, if given a too long URL. These overflows happen if you 1 - pass in a URL with no protocol like "http://" prefix, using no slash and the string is 256 bytes or longer. This leads to a single zero byte overflow of the heap...

[SA16971] PHP Trailing Slash "open_basedir" Security Bypass

TITLE: PHP Trailing Slash "openbasedir" Security Bypass SECUNIA ADVISORY ID: SA16971 VERIFY ADVISORY: http://secunia.com/advisories/16971/ CRITICAL: Not critical IMPACT: Security Bypass WHERE: Local system SOFTWARE: PHP 4.4.x http://secunia.com/product/5768/ PHP 5.0.x...

CVE-2002-1748

Technical details for CVE-2002-1748 are not publicly available in the provided documents; no specifics on affected versions, root cause, impact, or remediation are given. Monitor for updates as information may be added.

CVE-2002-1748

Unknown vulnerability in Slash 2.1.x and 2.2 through 2.2.2, as used in Slashcode, allows remote authenticated users to gain access to arbitrary accounts...

CVE-2002-1748: Undefined Security Weakness

Unknown vulnerability in Slash 2.1.x and 2.2 through 2.2.2, as used in Slashcode, allows remote authenticated users to gain access to arbitrary accounts...

CVE-2005-1908: Undefined Security Weakness

Perception LiteWeb allows remote attackers to bypass access controls for files via an extra leading / slash or leading \ backslash in the URL...

LiteWEB Web Server 2.5 - Authentication Bypass

LiteWEB Web Server 2.5 - Authentication Bypass source: https://www.securityfocus.com/bid/13850/info LiteWeb Server is prone to a vulnerability that may let remote attackers bypass authentication. The specific issue is inadequate sanitization of user-supplied requests. In particular, there is an...

LiteWEB Web Server 2.5 - Authentication Bypass

source: https://www.securityfocus.com/bid/13850/info LiteWeb Server is prone to a vulnerability that may let remote attackers bypass authentication. The specific issue is inadequate sanitization of user-supplied requests. In particular, there is an error in the handling of slash characters '/'...

CVE-2004-1973

DiGi Web Server allows remote attackers to cause a denial of service CPU consumption via an HTTP GET request that contains a large number of / slash characters, which consumes resources when DiGi converts the slashes to \ backslash characters...

CVE-2003-1138

The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash //...

CVE-2003-1138: Undefined Security Weakness

The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash //...

CVE-2002-1647

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2002-1647: Undefined Security Weakness

The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL...