914 matches found
Caudium 1.x - Remote Denial of Service
source: https://www.securityfocus.com/bid/11567/info Caudium is reported prone to a remote denial of service vulnerability. Remote attackers may exploit this vulnerability to crash affected Web servers, denying service to legitimate users. Versions of Caudium prior to 1.4.4 RC2 are reported...
CVE-2002-1195
The CVE-2002-1195 entry describes a cross-site scripting (XSS) flaw in the ht://Check 1.1 PHP interface. The vulnerability allows remote web servers to inject arbitrary HTML, including script, through content provided to ht://Check’s PHP interface, via a web page. Public references in the connect...
Directory traversal in multiple Web-servers
It's possible to leave web root by using directory traversal...
CVE-2003-0532
Technical details for CVE-2003-0532 are not publicly available in the provided documents. The connected items discuss other Internet Explorer vulnerabilities (not CVE-2003-0532) such as CVE-2003-0838 and HTA-related issues; monitor for updates.
Web servers enable HTTP TRACE method by default
Overview The HTTP TRACE method returns the contents of client HTTP requests in the entity-body of the TRACE response. Attackers could leverage this behavior to access sensitive information, such as cookies or authentication data, contained in the HTTP headers of the request. Description The HTTP...
CVE-2002-1195
Cross-site scripting vulnerability XSS in the PHP interface for ht://Check 1.1 allows remote web servers to insert arbitrary HTML, including script, via a web page...
Apache web servers fail to handle chunks with a negative size
Overview There is a remotely exploitable vulnerability in the way that Apache web servers or other web servers based on their source code handle data encoded in chunks. This vulnerability is present by default in configurations of Apache web server versions 1.2.2 and above, 1.3 through 1.3.24, an...
Multiple Web Server on Windows MS/DOS Device Request Remote DOS
It was possible to freeze or reboot Windows by reading a MS/DOS device through HTTP, using a file name like CON\CON, AUX.htm, or AUX. An attacker could exploit this flaw to deny service to the affected system. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Securit...
Доступ к специальным устройствам в некоторых Web/FTP-серверах (special devices)
Возможно чтение/запись специальных устройств...
Other Web Servers vulnerable to %3f.jsp directory listing
I tried posting to Bugtraq...but perhaps this is the more appropriate mailing list. Anyways here are some Response headers to servers that are vulnerable to the 3f.jsp directory listing exploit -Slow2Show- University of Florida HTTP/1.0 200 OK Date: Fri, 30 Nov 2001 03:43:27 GMT Server:...
Entrust Bulletin E01-005: GetAccess Access Service vulnerability
Entrust Security Bulletin E01-005 ================================= Entrust GetAccesstm Access Service Vulnerability SUMMARY: ======== A vulnerability has been identified in Entrust GetAccess that could allow unauthorized retrieval of files on certain GetAccess web servers. Entrust recommends...
CVE-1999-1072
Excite for Web Servers EWS 1.1 allows local users to gain privileges by obtaining the encrypted password from the world-readable Architext.conf authentication file and replaying the encrypted password in an HTTP request to AT-generated.cgi or AT-admin.cgi...
CVE-1999-1073
Technical details about CVE-1999-1073 are not publicly provided in the supplied documents. Monitor for updates from NVD/CVE listings.
CVE-1999-1071
Excite for Web Servers EWS 1.1 installs the Architext.conf authentication file with world-writeable permissions, which allows local users to gain access to Excite accounts by modifying the file...
CVE-1999-1073
Excite for Web Servers EWS 1.1 records the first two characters of a plaintext password in the beginning of the encrypted password, which makes it easier for an attacker to guess passwords via a brute force or dictionary attack...
Дырки в нескольких Web-серверах (buffer overflow, source code disclosure)
Переполнения буфера и другие дырки...
Netscape Enterprise Server Long Traversal Request Remote DoS
The remote web server seems to crash when it is issued a too long request with dots ie: ../../../../ 1000 times. An attacker may use this flaw to disable the remote server. C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription scriptid10689; scriptversion "1.26";...
iPlanet web servers expose sensitive data via buffer overflow
Overview A buffer overflow exists in the iPlanet Web Servers Enterprise and FastTrack Editions that may allow remote attackers to gain read access to sensitive information contained in the memory of the web server process. The information disclosed may include userids, passwords, cookies or...
Resin Traversal Arbitrary File Access
It is possible to read arbitrary files on the remote server by prepending /../../ to the file name. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10656; scriptversion"1.26"; scriptcvsdate"Date: 2018/07/27 18:38:15"; scriptcveid"CVE-2001-0304"; scriptbugtraqid2384;...