Microsoft IIS 'bdir.htr' Default Files - Active Check

The file bdir.htr is a default IIS files which can give a malicious user a lot of unnecessary information about your file system. SPDX-FileCopyrightText: 2003 John Lampe Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Authentication bypassing in Lotus Domino

By creating a specially crafted url, the authentication mechanism of Domino database can be circumvented. SPDX-FileCopyrightText: 2002 Davy Van De Moere Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

Hidden WWW server name

It seems that your web server tries to hide its version or name, which is a good thing. However, using a special crafted request, OpenVAS was able to discover it. OpenVAS Vulnerability Test $Id: wwwservername.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: Hidden WWW server name Authors:...

robot(s).txt exists on the Web Server

Web Servers can use a file called /robots.txt to ask search engines to ignore certain files and directories. By nature this file can not be used to protect private files from public read access. OpenVAS Vulnerability Test $Id: webserverrobot.nasl 6053 2017-05-01 09:02:51Z teissa $ Description:...

BEA WebLogic Operator/Admin Password Disclosure Vulnerability

BEA WebLogic Server and WebLogic Express are prone to a vulnerability that may result in the disclosure of Operator or Admin passwords. SPDX-FileCopyrightText: 2004 Astharot Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Test HTTP dangerous methods

Misconfigured web servers allows remote clients to perform dangerous HTTP methods such as PUT and DELETE. SPDX-FileCopyrightText: 2000 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Microsoft IIS 'Codebrws.asp' Source Disclosure Vulnerability - Active Check

Microsoft SPDX-FileCopyrightText: 2002 Matt Moore / HD Moore Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:internetinformationservices"; ifdescription...

Novell NetWare HTTP POST Perl Code Execution Vulnerability

Novell Netware contains multiple default web server installations. SPDX-FileCopyrightText: 2002 visigoth Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Outlook Web Access URL Injection

Due to a lack of sanitization of the user input, the remote version of Microsoft Outlook Web Access 2003 is vulnerable to URL injection which can be exploited to redirect a user to a different, unauthorized web server after authenticating to OWA. SPDX-FileCopyrightText: 2005 Michael J. Richardson...

Mailman private.py Directory Traversal Vulnerability

Authenticated Mailman users can view arbitrary files on the remote host. Description : According to its version number, the remote installation of Mailman reportedly is prone to a directory traversal vulnerability in 'Cgi/private.py'. The flaw comes into play only on web servers that don't strip...

RDS / MDAC Vulnerability (msadcs.dll) located

The web server is probably susceptible to a common IIS vulnerability discovered by 'Rain Forest Puppy'. This vulnerability enables an attacker to execute arbitrary commands on the server with Administrator Privileges. OpenVAS solely relied on the presence of the file /msadc/msadcs.dll so this mig...

FastCGI samples Cross Site Scripting

Two sample CGI's supplied with FastCGI are vulnerable to cross-site scripting attacks. FastCGI is an 'open extension to CGI that provides high performance without the limitations of server specific APIs', and is included in the default installation of the 'Unbreakable' Oracle9i Application Server...

Tomcat /status information disclosure

Requesting the URI /status gives information about the currently running Tomcat. SPDX-FileCopyrightText: 2003 StrongHoldNet Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Private IP address Leaked using the PROPFIND method

The remote web server leaks a private IP address through the WebDAV interface. If this web server is behind a Network Address Translation NAT firewall or proxy server, then the internal IP addressing scheme has been leaked. This is typical of IIS 5.0 installations that are not configured properly...

JServ Cross Site Scripting

The remote web server is vulnerable to a cross-site scripting issue. Older versions of JServ including the version shipped with Oracle9i App Server v1.0.2 are vulnerable to a cross site scripting attack using a request for a non-existent .JSP file. SPDX-FileCopyrightText: 2002 Matt Moore Some tex...

Tripwire for Webpages Detection (HTTP)

We detected the remote web server is running Tripwire for Webpages under the Apache HTTP Server. SPDX-FileCopyrightText: 2001 SecuriTeam Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FastCGI samples Cross Site Scripting

Two sample CGI SPDX-FileCopyrightText: 2002 Matt Moore Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.10838";...

httpXSS.txt

The following web servers do not properly sanitize their output when returning a 404 resource not found error which could be used in a XSS attack: Orion 1.3.8 Orion 1.4.5 CompaqHTTPServer 2.1 PoC: http://localhost/alert'XSS' -- - Josh...

404 error XSS

The following web servers do not properly sanitize their output when returning a 404 resource not found error which could be used in a XSS attack: Orion 1.3.8 Orion 1.4.5 CompaqHTTPServer 2.1 PoC: http://localhost/scriptalert'XSS'/script -- - Josh...

Embedded Web Server Detection

The remote web server cannot host user-supplied CGIs. CGI scanning will be disabled on this server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid19689; scriptversion"1.84"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/09/29";...