821 matches found
Sambar Server 5.1 - Script Source Disclosure
Sambar Server 5.1 - Script Source Disclosure source: https://www.securityfocus.com/bid/4533/info An issue has been discovered in Sambar Server, which could allow a user to reveal the source code of script files. Submitting a request for a known script file along with a space and null character %0...
Burning Board 1.1.1 - 'URL' Manipulation
source: https://www.securityfocus.com/bid/4512/info Burning Board is web forum software. It is written in PHP, back-ended by MySQL, and will run on most Unix and Linux variants as well as Microsoft Windows. An attacker may allegedly create a malicious link which is capable of causing actions to b...
Burning Board 1.1.1 - URL Manipulation
Burning Board 1.1.1 - URL Manipulation source: https://www.securityfocus.com/bid/4512/info Burning Board is web forum software. It is written in PHP, back-ended by MySQL, and will run on most Unix and Linux variants as well as Microsoft Windows. An attacker may allegedly create a malicious link...
CVE-2002-0112
Etype Eserv 2.97 allows remote attackers to view password protected files via /./ in the URL...
CVE-2002-0112
Etype Eserv 2.97 allows remote attackers to view password protected files via /./ in the URL...
CVE-2001-1152
Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorized web servers by modifying the requested URL, including 1 a // double slash, 2 a /SUBDIR/.. where the desired file is in the parentdir, 3 ...
CVE-2001-0574
Directory traversal vulnerability in MP3Mystic prior to 1.04b3 allows a remote attacker to download arbitrary files via a '..' dot dot in the URL...
CVE-2002-1603
GoAhead Web Server 2.1.7 and earlier allows remote attackers to obtain the source code of ASP files via a URL terminated with a /, , %2f encoded /, %20 encoded space, or %00 encoded null character, which returns the ASP source code unparsed...
Вставка скриптов в URL в Horde IMP (crossite scripting)
Вставив скрипт в URL можно получить доступ к сеансовым cookie...
Microsoft Internet Explorer 56 - Cookie DisclosureModification
Microsoft Internet Explorer 56 - Cookie DisclosureModification source: https://www.securityfocus.com/bid/3513/info Internet Explorer contains a vulnerability, which could allow an attacker to construct a URL that would display or modify the cookie information associated with an arbitrary website...
IBM AS/400 HTTP Server '/' attack
IBM's HTTP Server on the AS/400 platform is vulnerable to an attack that will show the source code of the page -- such as an .html or .jsp page -- by attaching an '/' to the end of a URL. Compare these two URL's: http://www.foo.com/getsource.jsp http://www.foo.com/getsource.jsp/ The later URL wil...
Microsoft Internet Explorer 5/6 - Cookie Disclosure/Modification
source: https://www.securityfocus.com/bid/3513/info Internet Explorer contains a vulnerability, which could allow an attacker to construct a URL that would display or modify the cookie information associated with an arbitrary website. If a URL is composed in the about: protocol referencing a...
CVE-2001-0729
Apache 1.3.20 on Windows servers allows remote attackers to bypass the default index page and list directory contents via a URL with a large number of / slash characters...
CVE-1999-1509
CVE-1999-1509 affects Etype Eserv 2.50 web server, where a directory traversal via .. in a URL allows a remote attacker to read arbitrary files on the server. This vulnerability is documented in multiple sources (NVD, CVE list, Nessus generic check) with the same root cause and impact. The connec...
CVE-1999-1509
Directory traversal vulnerability in Etype Eserv 2.50 web server allows a remote attacker to read any file in the file system via a .. dot dot in a URL...
CVE-2001-0614
CVE-2001-0614 affects Carello E-Commerce. Connected sources confirm a remote command-execution vulnerability in Carello.dll up to version 1.3, exploitable via a specially crafted URL, allowing arbitrary commands with the web server’s privileges. Impact is described as remote code execution with w...
CVE-2001-1026
Trend Micro InterScan AppletTrap 2.0 does not properly filter URLs when they are modified in certain ways such as 1 using a double slash // instead of a single slash, 2 URL-encoded characters, 3 requesting the IP address instead of the domain name, or 4 using a leading 0 in an octet of an IP...
CVE-2001-0439
licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...
WebTrends Enterprise Reporting Server 3.1 c3.5 - Source Code Disclosure
WebTrends Enterprise Reporting Server 3.1 c3.5 - Source Code Disclosure source: https://www.securityfocus.com/bid/2812/info WebTrends Live is a web-based reporting service which provides interactive tracking of usage statistics and E-commerce revenue. It is possible to view the source code of...