PT-2002-2538 · Atp · Atophttpd

Name of the Vulnerable Software and Affected Versions: ATPhttpd versions 0.4b and earlier Description: The issue is an off-by-one buffer overflow in the sock gets function in sockhelp.c, which allows remote attackers to execute arbitrary code via a long HTTP GET request. Recommendations: For...

Perception LiteServe 2.0 - CGI Source Disclosure

Perception LiteServe 2.0 - CGI Source Disclosure source: https://www.securityfocus.com/bid/6188/info By constructing a malicious web request, it is possible for a remote attacker to disclose the source code of CGI scripts. Information gained through exploiting this issue may aid an attacker in...

Perception LiteServe 2.0 - CGI Source Disclosure

source: https://www.securityfocus.com/bid/6188/info By constructing a malicious web request, it is possible for a remote attacker to disclose the source code of CGI scripts. Information gained through exploiting this issue may aid an attacker in launching further attacks against the target system...

Mollensoft Software Enceladus Server Suite 2.6.13.9 - Directory Traversal

Mollensoft Software Enceladus Server Suite 2.6.13.9 - Directory Traversal source: https://www.securityfocus.com/bid/6338/info It has been reported that Enceladus fails to properly sanitize web requests. By sending a malicious web request to the vulnerable server, using directory traversal...

MailReader.com 2.3.x - 'NPH-MR.cgi' File Disclosure

source: https://www.securityfocus.com/bid/6055/info A vulnerability exists in Mailreader.com which may enable remote attackers to disclose the contents of arbitrary webserver readable files. An attacker may exploit this issue by submitting a malicious web request containing dot-dot-slash ../...

CVE-2002-1069

The remote administration capability for the D-Link DI-804 router 4.68 allows remote attackers to bypass authentication and release DHCP addresses or obtain sensitive information via a direct web request to the pages 1 release.htm, 2 Device Status, or 3 Device Information...

TightAuction 3.0 - Config.INC Information Disclosure

TightAuction 3.0 - Config.INC Information Disclosure source: https://www.securityfocus.com/bid/5850/info TightAuction is prone to an information disclosure vulnerability. The configuration file config.inc contains sensitive information such as database authentication credentials. It is possible f...

WoltLab Burning Board 2.0 - SQL Injection

WoltLab Burning Board 2.0 - SQL Injection source: https://www.securityfocus.com/bid/5675/info WoltLab is prone to SQL injection attacks. This is due to insufficient sanitization of parameters handled by the board.php script, which may be supplied externally via the query string in a web request...

Seanox DevWex Windows Binary 1.2002.520 - File Disclosure

Seanox DevWex Windows Binary 1.2002.520 - File Disclosure source: https://www.securityfocus.com/bid/4978/info The Seanox DevWex Windows binary version is prone to an issue which may cause arbitrary web-readable files to be disclosed to remote attackers. This problem occurs because DevWex does not...

PHProjekt 2.x3.x - Authentication Bypass

PHProjekt 2.x3.x - Authentication Bypass source: https://www.securityfocus.com/bid/4596/info PHProjekt is a freely available, open source PHP Groupware package. It is actively maintained by the PHPProjekt Development Team. It will run on most Linux and Unix variants, in addition to Microsoft...

PHProjekt 2.x/3.x - Authentication Bypass

source: https://www.securityfocus.com/bid/4596/info PHProjekt is a freely available, open source PHP Groupware package. It is actively maintained by the PHPProjekt Development Team. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems. Some of the...

GNUJSP 1.0 - File Disclosure

source: https://www.securityfocus.com/bid/4125/info GNUJSP is a freely available, open-source implementation of Sun's Java Server Pages. It will run on most Unix and Linux variants, as well as Microsoft Windows NT/2000 operating systems. It has been reported that a remote attacker may disclose th...

Phusion WebServer 1.0 - Long URL Denial of Service

Phusion WebServer 1.0 - Long URL Denial of Service source: https://www.securityfocus.com/bid/4118/info Phusion Webserver is a commercial HTTP server that runs on Microsoft Windows 9x/NT/2000 operating systems. It is possible for a remote attacker to deny service to legitimate users of the service...

Phusion WebServer 1.0 - Long URL Denial of Service

source: https://www.securityfocus.com/bid/4118/info Phusion Webserver is a commercial HTTP server that runs on Microsoft Windows 9x/NT/2000 operating systems. It is possible for a remote attacker to deny service to legitimate users of the service by submitting an excessively long web request...

Agora.CGI 3/4 - Debug Mode Full Path Disclosure

source: https://www.securityfocus.com/bid/3976/info Agora.cgi is a freely available, open source shopping cart system. When debug mode is enabled, it is possible for a remote attacker to display the absolute path to the directory that the agora.cgi script is stored in. This is possible by making ...

Agora.CGI 34 - Debug Mode Full Path Disclosure

Agora.CGI 34 - Debug Mode Full Path Disclosure source: https://www.securityfocus.com/bid/3976/info Agora.cgi is a freely available, open source shopping cart system. When debug mode is enabled, it is possible for a remote attacker to display the absolute path to the directory that the agora.cgi...

EServ 2.9x - Password-Protected File Access

source: https://www.securityfocus.com/bid/3838/info EServ is a combination Mail, News, Web, FTP and Proxy Server for Microsoft Windows 9x/NT/2000 systems. It is possible to construct a web request which is capable of accessing the contents of password protected files/folders on the webserver, suc...

WikkiTikkiTavi 0.x - Remote File Inclusion

WikkiTikkiTavi 0.x - Remote File Inclusion source: https://www.securityfocus.com/bid/3946/info WikkiTikkiTavi is a freely available engine for running a Wiki site. Wiki sites are web communities which are based on the idea that every webpage is editable by users of the website. WikkiTikkiTavi is...

SnapStream Personal Video Station 1.2 a - PVS Directory Traversal

source: https://www.securityfocus.com/bid/3100/info Snapstream Personal Video Station is an application for Microsoft Windows which allows users to record video output on their PC and view it at a later time, locally or via an HTTP interface. The Snapstream PVS web interface runs on port 8129...

SnapStream Personal Video Station 1.2 a - PVS Directory Traversal

SnapStream Personal Video Station 1.2 a - PVS Directory Traversal source: https://www.securityfocus.com/bid/3100/info Snapstream Personal Video Station is an application for Microsoft Windows which allows users to record video output on their PC and view it at a later time, locally or via an HTTP...