CVE-2000-1171

Directory traversal vulnerability in cgiforum.pl script in CGIForum 1.0 allows remote attackers to ready arbitrary files via a .. dot dot attack in the "thesection" parameter...

Metertek pagelog.cgi Traversal Arbitrary File Access

The 'pagelog.cgi' cgi is installed. This CGI has a well known security flaw that lets an attacker create arbitrary files on the remote server, ending in .txt, and reading arbitrary files ending in .txt or .log Warning : this flaw was not tested by Nessus. Check the existence of...

iPlanet Directory Server Traversal Arbitrary File Access

There is a bug in the remote iPlanet web server that allows a user to read arbitrary files on the remote host. To exploit this flaw, an attacker needs to prepend '/../../' to the file name to read. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10589; scriptversion...

Technote main.cgi filename Parameter Traversal Arbitrary File Access

The technote CGI board is installed. This board has a well known security flaw in the CGI main.cgi that lets an attacker read arbitrary files with the privileges of the http daemon usually root or nobody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CVE-2000-0924

Directory traversal vulnerability in search.cgi CGI script in Armada Master Index allows remote attackers to read arbitrary files via a .. dot dot attack in the "catigory" parameter...

BOA Web Server 0.94.8.2 - Arbitrary File Access

ID: S21SEC-005-en Title: Vulnerability in BOA web server v0.94.8.2 Date: 03/10/2000 Status: Vendor contacted, patch available Scope: Arbitrary file access Platforms: Unix Author: llmora Location: http://www.s21sec.com/en/avisos/s21sec-005-en.txt Release: Public S 2 1 S E C http://www.s21sec.com...

BOA Web Server 0.94.8.2 - Arbitrary File Access

BOA Web Server 0.94.8.2 - Arbitrary File Access ID: S21SEC-005-en Title: Vulnerability in BOA web server v0.94.8.2 Date: 03/10/2000 Status: Vendor contacted, patch available Scope: Arbitrary file access Platforms: Unix Author: llmora Location: http://www.s21sec.com/en/avisos/s21sec-005-en.txt...

PHPix album Parameter Encoded Traversal Arbitrary File/Directory Access

The PHPix program allows an attacker to read arbitrary files on the remote web server, prefixing the pathname of the file with ..%2F..%2F.. For example: GET /Album/?mode=album&album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&dispsize=640&start=0 will return all the files that are nested within...

Microsoft IIS / Site Server viewcode.asp Arbitrary File Access

The file viewcode.asp is a default IIS file that can give a malicious user a lot of unnecessary information about your file system or source files. Specifically, viewcode.asp can allow a remote user to potentially read any file on a web server hard drive. %NASLMINLEVEL 70300 This script was writt...

Serv-U CD Command Encoded Traversal Arbitrary File/Directory Access

The remote host is running Serv-U FTP server. The installed version fails to properly sanitize user-supplied input to the 'cd' command. An attacker could exploit this flaw to access arbitrary files on the remote host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

Master Index search.cgi Traversal Arbitrary File/Directory Access

The version of Master Index running on the remote web server has a directory traversal vulnerability. Input to the 'catigory' parameter of search.cgi is not properly sanitized. A remote attacker could exploit this to read arbitrary files from the system. %NASLMINLEVEL 70300 C Tenable Network...

Markus Triska CGIForum 1.0 - thesection Directory Traversal

Markus Triska CGIForum 1.0 - thesection Directory Traversal source : https://www.securityfocus.com/bid/1963/info CGIForum is a commercial cgi script from Markus Triska which is designed to facilitate web-based threaded discussion forums. The script improperly validates user-supplied input to the...

CGIForum cgiforum.pl thesection Parameter Traversal Arbitrary File Access

The 'cgiforum.pl' CGI is installed. This CGI has a well known security flaw that could let a remote attacker read arbitrary files on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid10552;...

Ports Security Advisory: FreeBSD-SA-00:60.boa

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:60 Security Advisory FreeBSD, Inc. Topic: boa web server allows arbitrary file access/execution Category: ports Module: boa Announced: 2000-10-30 Credits: Lluis Mora...

CVE-2000-0767

The ActiveX control for invoking a scriptlet in Internet Explorer 4.x and 5.x renders arbitrary file types instead of HTML, which allows an attacker to read arbitrary files, aka the "Scriptlet Rendering" vulnerability...

CVE-2000-0845

CVE-2000-0845 affects Digital Unix 4.0F: the kdebugd daemon allows remote attackers to read arbitrary files by specifying the full path in the initialization packet. Exploitation status and remediation details are not provided in the supplied documents.

FreeBSD 4.1.1 Finger Arbitrary Remote File Access

The finger daemon running on the remote host will reveal the contents of arbitrary files when given a command similar to the following : finger /etc/passwd@target Which will return the contents of /etc/passwd. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10534;...

CVE-2000-0332

UltraBoard 1.6 is affected by a path traversal in UltraBoard.pl/UltraBoard.cgi that allows remote attackers to read arbitrary files by supplying a pathname containing .. followed by a null byte. The vulnerability is described as arbitrary file access via this traversal vector; no exploitation det...

CVE-2000-0537

BRU backup software allows local users to append data to arbitrary files by specifying an alternate configuration file with the BRUEXECLOG environmental variable...

eXtropia Web Store web_store.cgi Traversal Arbitrary File Access

The remote web server is hosting eXtropia WebStore, a shopping cart application. The installed version allows an attacker to read arbitrary files via a .. dot dot attack on the page parameter. %NASLMINLEVEL 70300 This script was written by Thomas Reinke See the Nessus Scripts License for details...