FTPGate Web Proxy Traversal Arbitrary File Access

It is possible to read arbitrary files on the remote server by prepending ../../ or ....\ in front of the file name. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10091; scriptversion "1.24"; scriptcvsdate"Date: 2018/08/10 18:07:08"; scriptnameenglish:"FTPGate Web...

CVE-1999-0475

The CVE-1999-0475 entry describes a race condition in procmail’s handling of .procmailrc files that allows a local user to read arbitrary files accessible to the procmail runner. Documents confirm the affected software is procmail, with the root cause being a race condition in .procmailrc process...

CVE-1999-0035

CVE-1999-0035 concerns a race condition in the signal handling routine of ftpd, as reported across multiple feeds. The primary concrete detail is that the vulnerability affects ftpd and permits read/write of arbitrary files due to a race condition in its signal handling. The Red Hat and other ent...

CVE-1999-0466

The SVR4 /dev/wabi special device file in NetBSD 1.3.3 and earlier allows a local user to read or write arbitrary files on the disk associated with that device...

CVE-1999-0474

The ICQ Webserver allows remote attackers to use .. to access arbitrary files outside of the user's personal directory...

procmail.screen.txt

Date: Mon, 5 Apr 1999 19:40:37 +0100 From: Chris Evans To: [email protected] Subject: More procmail Hi, Well well since Debian appear to have "broken silence" on the procmail front rather than wait for an official announcement... I found something potentially more serious than boring heap...

Microsoft IIS / Site Server showcode.asp source Parameter Traversal Arbitrary File Access

Internet Information Server IIS 4.0 ships with a set of sample files to help web developers learn about Active Server Pages ASP. One of these sample files, 'showcode.asp' installed in /msadc/Samples/SELECTOR/, is designed to view the source code of the sample applications via a web browser. The...

Miva htmlscript Traversal Arbitrary File Access

The 'htmlscript' cgi is installed. This CGI has a well known security flaw that lets anyone read arbitrary files with the privileges of the HTTP daemon root or nobody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription...

iChat Server Traversal Arbitrary File Access

iChat servers up to version 3.00 allow any user to read arbitrary files on the target system using a directory traversal attack. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10110; scriptversion "1.31"; scriptcvsdate"Date: 2018/11/15 20:50:25";...

icat carbo.dll icatcommand Parameter Traversal Arbitrary File Access

The installed version of the 'icat' CGI allows a remote user to read arbitrary files on the remote target, because it fails to properly sanitize user-supplied input to the 'icatcommand' parameter. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Microsoft Personal Web Server Multiple Dot Request Arbitrary File Access

It is possible to read any file on the remote system by prepending several dots before the file name. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid10142; scriptversion"1.31";...

thttpd Double Slash Request Arbitrary File Access

The remote HTTP server allows an attacker to read arbitrary files on the remote host with the privileges of the web server, simply by adding a slash in front of its name. For instance, 'GET //etc/passwd' will return the contents of the remote file '/etc/passwd'. C Tenable Network Security, Inc...

PHP/FI php.cgi Traversal Arbitrary File Access

'php.cgi' is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the HTTP server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid10177;...

IRIX pfdispaly Arbitrary File Access

The 'pfdispaly' CGI is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the http daemon usually root or nobody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

Multiple Vendor test-cgi Arbitrary File Access

The remote web server contains the 'test-cgi' test script, which is included by default with some web servers. The version of this script on the remote host fails to quote input to several environment variables, such as 'QUERYSTRING', before echoing it back as part of a shell script. An...

Multiple Vendor view_source CGI Traversal Arbitrary File Access

The 'viewsource' CGI is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the http daemon usually root or nobody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik...

WebCom datakommunikation Guestbook 0.1 - rguest.exe Arbitrary File Access

WebCom datakommunikation Guestbook 0.1 - rguest.exe Arbitrary File Access source: https://www.securityfocus.com/bid/2024/info The freeware guestbook package from freeware.webcom.se provides a web-based guestbook feature, using CGI. Some versions of this guestbook undetermined at the time of writi...

WebCom datakommunikation Guestbook 0.1 - wguest.exe Arbitrary File Access

WebCom datakommunikation Guestbook 0.1 - wguest.exe Arbitrary File Access source: https://www.securityfocus.com/bid/2024/info The freeware guestbook package from freeware.webcom.se provides a web-based guestbook feature, using CGI. Some versions of this guestbook undetermined at the time of writi...

WebCom datakommunikation Guestbook 0.1 - 'wguest.exe' Arbitrary File Access

source: https://www.securityfocus.com/bid/2024/info The freeware guestbook package from freeware.webcom.se provides a web-based guestbook feature, using CGI. Some versions of this guestbook undetermined at the time of writing are vulnerable to an attack allowing an intruder to retrieve the conten...

WebCom datakommunikation Guestbook 0.1 - 'rguest.exe' Arbitrary File Access

source: https://www.securityfocus.com/bid/2024/info The freeware guestbook package from freeware.webcom.se provides a web-based guestbook feature, using CGI. Some versions of this guestbook undetermined at the time of writing are vulnerable to an attack allowing an intruder to retrieve the conten...