phpMyAdmin export.php what Parameter Traversal Arbitrary File Access

There is a bug in the remote version of phpMyAdmin that may allow an attacker to read arbitrary files on the remote web server with the privileges of the web user or even execute arbitrary PHP code. Successful exploitation of this issue requires that PHP's 'magicquotesgpc' setting be disabled...

MegaBrowser 0.3 - HTTP Directory Traversal

MegaBrowser 0.3 - HTTP Directory Traversal source: https://www.securityfocus.com/bid/7802/info The MegaBrowser HTTP server component is prone to a file disclosure vulnerability. Directory traversal sequences may be used to break out of the web root directory. Attackers may gain access to files th...

Tomcat /status Information Disclosure

Requesting the URI '/status' gives information about the currently running instance of the remote web server most likely Apache Tomcat. It also allows anybody to reset the current statistics. A remote attacker can use this information to mount further attacks. This script was written by Vincent...

Simple Web Server protected files access

URL http://server.com///secret/file allows protected file access...

SWS Simple Web Server 0.0.3/0.0.4/0.1 - New Line Denial of Service

// source: https://www.securityfocus.com/bid/5664/info SWS Simple Web Server is prone to a denial of service when requests not ending with a newline are received. Remote attackers may exploit this condition to deny access to legitimate users of the web server. / Mon Sep 2 17:45:04 2002 |SaMaN| ak...

EUVD-2002-0778

iCon administrative web server for Critical Path inJoin Directory Server 4.0 allows authenticated inJoin administrators to read arbitrary files by specifying the target file in the LOG parameter...

BSCW vulnerable to arbitrary file overwriting via symlink redirection of temporary file

Overview BSCW is a groupware system that runs on a web server. BSCW follows symbolic links in tar files that it extracts into a user's local area. Accessing those links may allow the user to view arbitrary files viewable by the web server, and to overwrite files writable by the web server...

PHPLib Team PHPLIB 7.2 - Remote Script Execution

source: https://www.securityfocus.com/bid/3079/info The PHP Base Library'PHPLIB' is a code library which provides support for session management in web applications. It is targeted to developers and is widely used in many web applications, so a strong possibility exists that an application may be...

alex heiphetz Group eZshopper 2.03.0 - Directory Traversal

alex heiphetz Group eZshopper 2.03.0 - Directory Traversal source: https://www.securityfocus.com/bid/2109/info It is possible for a remote user to gain read access to various files that reside within the EZShopper directory. By requesting a specially crafted URL utilizing loadpage.cgi' applicatio...

Ipswitch IMail 6.x - File Attachment

Ipswitch IMail 6.x - File Attachment source: https://www.securityfocus.com/bid/1617/info IPSWITCH ships a product titled IMail, an email server for usage on NT servers serving clients their mail via a web interface. To this end the IMail server provides a web server typically running on port 8383...

robpoll-cgi-problem.txt

Software: Robpoll.cgi URL: http:// Platforms: Unix, NT Type: CGI, Change password by default robpoll.cgi Remote Possible Problem discovered by Nick: alt3kx Mail: [email protected] Webs: w w w . h e r t m x . o r g w w w . s 0 d . o r g w w w . r a z a - m e x i c a n a . o r g Summary:...

Big Brother filename extension vulnerability

versions affected: bb14h2 current and older exploit: bbd listens for incoming connections on port 1984. Using telnet or the bb client, it is possible to connect and create a filename with an arbitrary extension, as the extension is not rigorously checked. As this file is droped into a directory...

CGI City CC Whois 1.0 - MetaCharacter

source: https://www.securityfocus.com/bid/2000/info Whois scripts provide InterNIC lookup services via HTTP. The vulnerable scripts include versions of Matt's Whois and CGI City Whois. Older versions of these fail to filter metacharacters, allowing execution of arbitrary commands by embedding the...

CVE-1999-0408

Files created from interactive shell sessions in Cobalt RaQ microservers e.g. .bashhistory are world readable, and thus are accessible from the web server...

Greg Matthews - Classifieds.cgi 1.0 MetaCharacter

Greg Matthews - Classifieds.cgi 1.0 MetaCharacter source: https://www.securityfocus.com/bid/2020/info Classifieds.cgi is a perl script part of the classifieds package by Greg Matthews which provides simple classified ads to web sites. Due to improper input validation it can be used to read files ...

PT-1997-1076 · Nms · Formmail Cgi

Name of the Vulnerable Software and Affected Versions: FormMail CGI program affected versions not specified Description: The issue concerns the FormMail CGI program, which can be utilized by web servers other than the host server where the program resides. Recommendations: At the moment, there is...