Blue Panda Vulnerability Announcement: WFTPD/WFTPD Pro 2.41 RC12

================================================================= Blue Panda Vulnerability Announcement: WFTPD/WFTPD Pro 2.41 RC12 05/09/2000 dd/mm/yyyy [email protected] http://bluepanda.box.sk/ ================================================================= Problem: WFTPD will crash if a...

Проблемы в сервере Roxen

Используя нулевой символ 00 можно просматривать листинги директорий, получать содержимое исполняемых файлов и т.д...

Roxen security alert: Problems with URLs containing null characters.

Roxen 2.0 up to version 2.0.68 has a vulnerability where using URLs containing null characters can gain the browser access to information he is not authorized to: Directory listings in directories with index files In normal filesystems: the sourcecode for RXML files, Pike scripts, CGIs etc...

CVE-2000-0671

Roxen web server earlier than 2.0.69 allows allows remote attackers to bypass access restrictions, list directory contents, and read source code by inserting a null character %00 to the URL...

Roxen WebServer 2.0.x - %00 Request FileDirectory Disclosure

Roxen WebServer 2.0.x - %00 Request FileDirectory Disclosure source: https://www.securityfocus.com/bid/1510/info If a request containing the null character %00 is made to the Roxen Web Server, the server will return directory contents, and the source of unparsed scripts and html pages. For exampl...

Roxen WebServer 2.0.x - '%00' Request File/Directory Disclosure

source: https://www.securityfocus.com/bid/1510/info If a request containing the null character %00 is made to the Roxen Web Server, the server will return directory contents, and the source of unparsed scripts and html pages. For example, a request to http://www.server.com/%00 Will return the...

CVE-2000-0024

CVE-2000-0024 affects Microsoft IIS. The vulnerability is caused by improper URL canonicalization, enabling remote attackers to bypass access controls in third-party software through escape characters. The provided documents identify the issue and its description, but do not include concrete reme...

CVE-2000-0014

The CVE-2000-0014 entry describes a denial-of-service in the Savant web server triggered by a crafted URL containing a null character. The impact is a Partial Availability impact with no confidentiality or integrity impact, as per CVSS v2 metrics, and the exploitation could be performed over the ...

CVE-2000-0014

Denial of service in Savant web server via a null character in the requested URL...

CVE-2000-0024

IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the "Escape Character Parsing" vulnerability...

CVE-2000-0149

Zeus Web Server (versions 3.1.x–3.3.5) contains an information disclosure flaw where a null byte (%00) at the end of a URL allows remote attackers to view the source code of CGI scripts. Root cause: improper handling of CGI input leading to source disclosure. Impact is information exposure of CGI...

CVE-2000-0149

Zeus web server allows remote attackers to view the source code for CGI programs via a null character %00 at the end of a URL...

CVE-2000-0149

Zeus web server allows remote attackers to view the source code for CGI programs via a null character %00 at the end of a URL...

CVE-1999-0163

CVE-1999-0163 affects older Sendmail versions. An attacker could use a pipe character to execute root commands, enabling local privilege escalation. Affected data shows multiple advisories citing Sendmail with this pipe-based command execution, including references to specific package versions (e...

CVE-1999-0703

OpenBSD, BSDI, and other Unix operating systems allow users to set chflags and fchflags on character and block devices...

CVE-2000-0014

Denial of service in Savant web server via a null character in the requested URL...

Michael Lamont Savant Web Server 2.0 - NULL Character Denial of Service

Michael Lamont Savant Web Server 2.0 - NULL Character Denial of Service source: https://www.securityfocus.com/bid/897/info The Savant Webserver cannot properly handle null characters in a GET request. If it encounters one, it will crash. The failure is logged in \Logs\general.txt http ://target/%...

Michael Lamont Savant Web Server 2.0 - NULL Character Denial of Service

source: https://www.securityfocus.com/bid/897/info The Savant Webserver cannot properly handle null characters in a GET request. If it encounters one, it will crash. The failure is logged in \Logs\general.txt http ://target/%00/...

CVE-1999-1357

Netscape Communicator 4.04 through 4.7 and possibly other versions in various UNIX operating systems converts the 0x8b character to a "" sign, which could allow remote attackers to attack other clients via cross-site scripting CSS in CGI programs that do not filter these characters...

iParty-DoS.txt

Date: Mon, 30 Nov 1998 21:46:52 -0600 From: HD Moore Reply-To: Bugtraq List To: [email protected] Subject: iParty can be shut down remotely -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iParty is an audio/text chat program for Windows. The iParty server listens on a specified port 6004 is...