WebStores 2000 browse_item_details.asp SQL Injection

The remote web server is running WebStores 2000, a set of ASP scripts designed to set up an e-commerce store. There is a flaw in the version of WebStores used on the remote host that may allow an attacker to make arbitrary SQL statements to the backend database. An attacker may be able to exploit...

iisCart2000 Administration Security Leak

1ndonesian Security Team 1st http://bosen.net/releases/ ======================================================================= ======================= Security Advisory Advisory Name: iisCart2000 Administration Security Leak Release Date: 05/10/2003 Application: Latest Platform: Win32 Severity:...

CVE-2003-0225

Affected software: Microsoft IIS 4.0 and 5.0. Vulnerable component: ASP Response.AddHeader handling, which fails to cap memory usage when constructing headers. Impact: remote attackers can craft an ASP page to generate a large header, causing memory exhaustion and denial of service. Root cause (p...

CVE-2003-0223

Microsoft IIS 4.0/5.0/5.1 is affected by a cross-site scripting (XSS) vulnerability in the ASP redirection function that allows remote attackers to embed script in a redirection URL/message. The issue is identified as CVE-2003-0223 (MS03-018), with a patch referenced as Microsoft security bulleti...

Microsoft IIS local ASP DoS

Insertion of oversized header line via Response.AddHeader causes server to crash...

Microsoft Active Server Pages DoS

AQTRONIX Security Advisory AQ-2003-01 ===================================== Topic: Microsoft Active Server Pages DoS Release date: 18 April 2003 Systems Tested: Windows 2000 Server Family + SP3 + MS02-062 Affected Systems: IIS 4.0, IIS 5.0, IIS 5.1 with ASP 3.0 installed I did not test previous...

Web Wiz Forums all version db stealing

.:: Decription ::. Web Wiz Forums, the free award winning ASP bulletin board system is available in a boxed version with link removal code. .:: Vendor ::. http://www.webwizguide.info .:: Problem ::. By default all passwords are kept on admin/wwforum.mdb Example:...

Web Wiz Forums wwforum.mdb Direct Request Database Disclosure

The remote server is running Web Wiz Site Forum, a set of ASP scripts to manage online forums. This release comes with a 'wwforum.mdb' database, usually located under 'admin', that contains sensitive information, such as the user passwords and emails. An attacker may use this flaw to gain...

FipsGuestbook Version 1.12.7 script injection.

Date: 14.04.2003 Subject: FipsGuestbook Version 1.12.7 script injection. Description: Written entirely in ASP and VBScript, easy to install ASP guestbook manager with web based administration panel. Vendor: FipsASP http://www.fips.at.tf Vulnerability: newentry.asp neglects filtering user input...

Web Wiz Site News / Compulsive Media CNU5 news.mdb Direct Request Database Disclosure

The remote server is running Web Wiz Site News or Compulsive Media CNU5, a set of ASP scripts to manage a news website. This release comes with a 'news.mdb' database that contains sensitive information, such as the unencrypted news site administrator password and URLs to several news stories. An...

Ocean12 ASP Guestbook Manager v1.00

This advisory can be found at www.blacktigerz.org Subject: Ocean12 ASP Guestbook Manager v1.00. Description: Written entirely in ASP and VBScript this is a completely web-based, easy to install, ASP Guestbook Program. It stores data in an Access 2000 database and is configured 100 through the web...

CVE-2002-0149

Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names...

CVE-2002-0149

CVE-2002-0149 concerns a buffer overflow in the IIS ASP Server-Side Include (SSI) processing when handling long file names. The issue affects Microsoft IIS 4.0, 5.0 and 5.1, and can allow a remote attacker to crash the server or potentially execute arbitrary code via crafted SSI inputs. Multiple ...

MS00-019: Microsoft IIS ISAPI Virtual Directory UNC Mapping ASP Source Disclosure (uncredentialed check)

It is possible to get the source code of the remote ASP scripts which are hosted on a mapped network share by appending '%5c' to the end of the request. ASP source code usually contains sensitive information such as logins and passwords. %NASLMINLEVEL 70300 [email protected] http://libpcap.net See...

CVE-2002-1699

SQL injection vulnerability in ASP Client Check ASPCC 1.3 and 1.5 allows remote attackers to bypass authentication and gain unauthorized access via the password field...

CVE-2002-1919

SQL injection vulnerability in shopadmin.asp in VP-ASP 4.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username or 2 password fields...

GoAhead Web Server 2.1.x - .ASP File Source Code Disclosure

GoAhead Web Server 2.1.x - .ASP File Source Code Disclosure source: https://www.securityfocus.com/bid/9239/info A vulnerability in GoAhead webserver may result in the disclosure of the source code of ASP script files. The vulnerability occurs because the application fails to sanitize HTTP request...

GoAhead Web Server 2.1.x - '.ASP' File Source Code Disclosure

source: https://www.securityfocus.com/bid/9239/info A vulnerability in GoAhead webserver may result in the disclosure of the source code of ASP script files. The vulnerability occurs because the application fails to sanitize HTTP requests. An attacker can append certain characters to the end of a...

Advisory Title: iASP Remote Console Applet Allows Remote

Fate Research Laboratories Security Advisory --------------------------------------------------------------------- Advisory Title: Remote Console Applet Allows Remote File Retrieval Package: Instant ASP iASP Vendor: Halcyon Software Vendor Web Site: http://www.stryon.com Versions: = v1.0.9 Latest...

Microsoft Windows XP2000NT 4.0 - RPC Service Denial of Service (1)

Microsoft Windows XP2000NT 4.0 - RPC Service Denial of Service 1 // source: https://www.securityfocus.com/bid/6005/info The Microsoft Windows RPC service contains a flaw that may allow a remote attacker to cause a denial of service. By sending a specifically malformed packet to TCP port 135, the...