CVE-2001-0892

Vulnerability : Acme Thttpd Secure Webserver prior to 2.22, with the chroot option enabled, is exposed to remote access that can view sensitive files under the document root (e.g., .htpasswd) via a GET request with a trailing slash. Affected product : Acme Thttpd Secure Webserver (before 2.22). R...

CVE-2001-0971

CVE-2001-0971 affects the ACI/4D WebServer. The 4D WebServer (versions 6.5.7 and earlier) fails to validate HTTP requests, enabling directory traversal that allows remote attackers to read arbitrary files outside the web root. Impact is remote file disclosure with web server privileges. The CERT/...

Enumerating users on a Domino webserver

Hi, during a pen-test against a Domino 5.0.8 webserver, I was able to enumerate valid users. A simple "GET /mail/toto.nsf HTTP/1.0" redirects to the login page with a "200 OK" HTTP code if the user "toto" exists and a "404 File not Found" is returned if the user doesn't exist. This issue can allo...

CyberStop-Server-DoS-remote-attacks

------oOo------ CyberStop WEbserver DoS Remote attacks. ------oOo------ CyberStop WEbserver for Windows 9x/NT/2000 contains remote vulnerabilities which allow users to attack remote services on the server. Exploit information included. Company Affected: www.cyberstop.com.sg Download:...

PHP-Nuke 4.x5.x - Arbitrary File Inclusion

PHP-Nuke 4.x5.x - Arbitrary File Inclusion source: https://www.securityfocus.com/bid/3889/info PHPNuke is a website creation/maintenance tool. The 'index.php' script has a feature which allows users to include files. Due to insufficent input validation, it is possible to include files located on ...

Sambar Webserver v5.1 DoS Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sambar Webserver v5.1 DoS Vulnerability Type: DoS, crashes Daemon Release Date: December 16, 2002 Product / Vendor: Sambar Server is a multi-threaded HTTP server for Microsoft Windows and Unix systems. http://www.sambar.com Summary: Sambar Webserver i...

PHP-Nuke 4.x/5.x - Arbitrary File Inclusion

source: https://www.securityfocus.com/bid/3889/info PHPNuke is a website creation/maintenance tool. The 'index.php' script has a feature which allows users to include files. Due to insufficent input validation, it is possible to include files located on a remote server. Arbitrary code in the...

File Transversal Vulnerability in Dino's WebServer

Dino's WebServer, File Transversal Vulnerability Date: January 8, 2002 Author: CaMaLeOn Affected: Dino's WebServer Tested by: CaMaLeOn, DraZiw, WiZaRd Versions Test: 1.x Vendor Status: Notified Plattaforms: win9x, win2000, WinNT Dino's Webserver is a small and very simple to use web server that i...

Savant Webserver Buffer Overflow Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Savant Webserver Buffer Overflow Vulnerability Type: DoS, crashes Daemon Release Date: January 5, 2002 Product / Vendor: Savant is a freeware open source web server that runs on Windows 95, 98, ME, NT, and 2000, turning any desktop computer into a...

WikkiTikkiTavi 0.x - Remote File Inclusion

WikkiTikkiTavi 0.x - Remote File Inclusion source: https://www.securityfocus.com/bid/3946/info WikkiTikkiTavi is a freely available engine for running a Wiki site. Wiki sites are web communities which are based on the idea that every webpage is editable by users of the website. WikkiTikkiTavi is...

Alteon AceDirector - Half-Closed HTTP Request IP Address Revealing

source: https://www.securityfocus.com/bid/3964/info Alteon ACEdirector is a hardware solution distributed by Nortel Networks. ACEdirector runs the Nortel WebOS operating system. It is possible to retrieve the real IP addresses of webservers that are managed by an ACEdirector. When a client is...

easynews 1.5 let's remote users modify database

Hey, that's my first submission so don't expect anything spectacular. There are a few bugs in Easynews 1.5: Short Description: Easynews 1.5 - database and templates remotly modifieable, cross site scripting, local users gain admin pass, and stuff : Found by: markus [email protected] Vendor...

Xitami Webserver stores admin password in clear text.

I am releasing this a bit early as the vendor has been aware of this issue for a while now. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vapid Labs Larry W. Cashdollar Xitami Webserver clear text password storage vulnerability. Date Published: 11/23/2001 Advisory ID: 11232001-02 Title: Xitami...

New Roxen Webserver Library Issues

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++GOBBLES+SECURITY+RESEARCH+TEAM+INCORPORATED+++++++++++++++++ ALERT! ALERT! A NEW BUFFER OVERFLOW IN LIBRARY FROM ROXEN! ALERT! ALERT! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++...

IRM Security Advisory: Xcache Path Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- IRM Security Advisory No. 001 Xcache Webserver Cache Path Disclosure Vulnerability Vulnerablity Type / Importance: Information Leakage / Medium Problem discovered: Mon, 17 Sep 2001...

CVE-1999-1068

Oracle Webserver 2.1 is affected when serving PL/SQL stored procedures. A long HTTP GET request can trigger a denial-of-service by crashing the remote web server, via the cgi /ews-bin/fnord pathway. The vulnerability is documented in CVE-1999-1068 and is reflected in the Nessus plugin OWS_OVERFLO...

CVE-1999-1125

Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or remote attacker who obtains access to the oracle account to gain privileges or modify arbitrary files by modifying the configuration file...

CVE-1999-1081

The CVE-1999-1081 entry describes a vulnerability in the files.pl script of the Novell WebServer Examples Toolkit 2, which allows remote attackers to read arbitrary files. The connected documents do not provide additional exploitation details, root-cause analysis, affected versions beyond “Toolki...

CVE-1999-1068

Oracle Webserver 2.1, when serving PL/SQL stored procedures, allows remote attackers to cause a denial of service via a long HTTP GET request...

CVE-1999-1081

Vulnerability in files.pl script in Novell WebServer Examples Toolkit 2 allows remote attackers to read arbitrary files...