Zeroo HTTP Server 1.5 - Directory Traversal (2)

Zeroo HTTP Server 1.5 - Directory Traversal 2 source: https://www.securityfocus.com/bid/6308/info It has been reported that Zeroo fails to properly sanitize web requests. By sending a malicious web request to the vulnerable server, using directory traversal sequences, it is possible for a remote...

Zeroo HTTP Server 1.5 - Directory Traversal (1)

Zeroo HTTP Server 1.5 - Directory Traversal 1 // source: https://www.securityfocus.com/bid/6308/info It has been reported that Zeroo fails to properly sanitize web requests. By sending a malicious web request to the vulnerable server, using directory traversal sequences, it is possible for a remo...

Zeroo HTTP Server 1.5 - Directory Traversal (1)

// source: https://www.securityfocus.com/bid/6308/info It has been reported that Zeroo fails to properly sanitize web requests. By sending a malicious web request to the vulnerable server, using directory traversal sequences, it is possible for a remote attacker to access sensitive resources...

CVE-2002-1149

The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings...

CVE-2002-0892

The default configuration of NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to determine the path of the web root via a direct request to com.newatlanta.servletexec.JSP10Servlet without a filename, which leaks the pathname in an error message...

EmuMail 5.0 - Web Root Full Path Disclosure

source: https://www.securityfocus.com/bid/5823/info Emumail is an open source web mail application. It is available for the Unix, Linux, and Microsoft Windows operating systems. Under some conditions, Emumail may reveal sensitive configuration information. When unexpected characters are inserted...

zml.cgi does not adequately validate user input thereby allowing directory traversal

Overview zml.cgi does not adequately validate user input, allowing for directory traversal out of the web root directory. Description The perl script zml.cgi reads and parses a file on the server, executing certain Server Side Include SSI directives found in the file. The script accepts a CGI...

CVE-2002-1010

Lotus Domino R4 allows remote attackers to bypass access restrictions for files in the web root via an HTTP request appended with a "?" character, which is treated as a wildcard character and bypasses the web handlers...

Windows Apache directory traversal

It's possible to leave web rot folder by using backslash...

CVE-2002-0543

Directory traversal vulnerability in Aprelium Abyss Web Server abyssws before 1.0.0.2 allows remote attackers to read files outside the web root, including the abyss.conf file, via URL-encoded .. dot dot sequences in the HTTP request...

[ARL02-A14] ZenTrack System Information Path Disclosure Vulnerability

+/---------------- ALPER Research Labs ------/--------/+ +/---------------- Security Advisory -----/---------/+ +/---------------- ID: ARL02-A14 ----/----------/+ +/---------------- [email protected] ---/-----------/+ Advisory Information -------------------- Name : ZenTrack System Information...

Vulnerability in Apache Tomcat v3.23 & v3.24 (part 2)

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-06 Description: Tomcat realPath.jsp gives location of web root. Date: 8/1/2002 Application: Apache Tomcat Java server versions 3.23 and 3.24 Platform: Linux/Unix Severity: Remote attackers can obtain the location of webroot...

CVE-2002-0266

Thunderstone Texis CGI script allows remote attackers to obtain the full path of the web root via a request for a nonexistent file, which generates an error message that includes the full pathname...

CVE-2002-0196

GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or write files outside of the web root, in other directories whose path includes the web root...

CVE-2002-0266

The connected documents confirm CVE-2002-0266 affects Thunderstone Texis CGI scripts, enabling unauthenticated remote disclosure of the web root path by requesting a nonexistent file, with error messages revealing the full pathname. No fix/version remediation details are provided in the supplied ...

CVE-2002-0266

Thunderstone Texis CGI script allows remote attackers to obtain the full path of the web root via a request for a nonexistent file, which generates an error message that includes the full pathname...

KPMG-2002006: Lotus Domino Physical Path Revealed

-------------------------------------------------------------------- -=Lotus Domino Physical Path Revealed=- courtesy of KPMG Denmark BUG-ID: 2002006 Released: 02nd Apr 2002 -------------------------------------------------------------------- Problem: ======== Due to problems handling Windows DOS...

PHP-Nuke 5.x - Error Message Web Root Disclosure

PHP-Nuke 5.x - Error Message Web Root Disclosure source: https://www.securityfocus.com/bid/4333/info PHP-Nuke is a popular web based Portal system. It allows users to create accounts and contribute content to the site. A vulnerability has been reported in some versions of PHP-Nuke. Reportedly, a...

PHP-Nuke 5.x - Error Message Web Root Disclosure

source: https://www.securityfocus.com/bid/4333/info PHP-Nuke is a popular web based Portal system. It allows users to create accounts and contribute content to the site. A vulnerability has been reported in some versions of PHP-Nuke. Reportedly, a maliciously constructed HTTP request will cause t...

[ARL02-A11] Big Sam (Built-In Guestbook Stand-Alone Module) Multiple Vulnerabilities

+/---------------- ALPER Research Labs ------/--------/+ +/---------------- Security Advisory -----/---------/+ +/---------------- ID: ARL02-A11 ----/----------/+ +/---------------- [email protected] ---/-----------/+ Advisory Information -------------------- Name : Big Sam Built-In Guestbook...