341 matches found
CVE-2009-4530
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI...
CVE-2009-4535
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / slash character to the URI...
CVE-2009-4529
NaviCOPA Web Server (3.0.1.2 and earlier) is affected by CVE-2009-4529. A trailing encoded space in a request URI (e.g., /index.html%20 or /index.php%20) can disclose the server-side source code of pages/CGIs to a remote attacker. Affected product is NaviCOPA Web Server; root cause is improper ha...
CVE-2009-3544
Xerver HTTP Server 4.32 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name...
CVE-2008-6933
CVE-2008-6933 is a vulnerability in MiniGal b13 (MG2) where a directory traversal flaw in index.php allows remote attackers to read the source code of .php files and possibly other files by injecting “..” in the list parameter. Affected component: MiniGal b13 (MG2). Root cause: improper sanitizat...
CVE-2005-4833
The affected product is IBM WebSphere Application Server 6.0 prior to 20050201, vulnerable when serving pages in an Application WAR or an Extended Document Root. The root cause is lack of URL normalization, allowing remote attackers to access the JSP source code and other sensitive information vi...
CVE-2007-0585
include/debug.php in Webfwlog 0.92 and earlier, when registerglobals is enabled, allows remote attackers to obtain source code of files via the conffile parameter. NOTE: some of these details are obtained from third party information. It is likely that this issue can be exploited to conduct...
CVE-2006-4223
CVE-2006-4223 affects IBM WebSphere Application Server (WAS) before version 6.0.2.13. The issue involves JSP source code exposure via context-dependent paths when ibm-web-ext.xmi sets fileServingEnabled to true or when ExtendedDocumentRoot places a JSP outside a WAR file. This allows an attacker ...
CVE-2006-2248
Xeneo Web Server 2.2.22.0 allows remote attackers to obtain the source code of script files via crafted requests containing dot, space, and slash characters in the file extension...
CVE-2006-1598
AN HTTPD 1.42n, and possibly other versions before 1.42p, allows remote attackers to obtain source code of scripts via crafted requests with 1 dot and 2 space characters in the file extension...
CVE-2006-0816
Orion Application Server before 2.0.7, when running on Windows, allows remote attackers to obtain the source code of JSP files via 1 . dot and 2 space characters in the extension of a URL...
CVE-2006-0816
Orion Application Server before 2.0.7 on Windows is affected by a filename extension validation flaw that allows remote disclosure of JSP source code. An attacker can craft a URL with dot or space characters in the extension to reveal the contents of JSP files. The vulnerability impacts confident...
Cross site request forgery (csrf)
Dwarf HTTP Server 1.3.2 allows remote attackers to obtain the source code of JSP files via 1 dot, 2 space, 3 slash, or 4 NULL characters in the filename extension of an HTTP request...
CVE-2006-0949
RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving 1 "." dot, 2 space, and 3 "/" slash characters...
Code injection
RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving 1 "." dot, 2 space, and 3 "/" slash characters...
CVE-2004-2636
CVE-2004-2636 affects TinyWeb 1.9, where remote attackers can read the source code of scripts by using a URL containing "/./". The NVD entry shows a base score of 5.0 (Medium) with network access and low complexity, and partial confidentiality impact. Connected sources also corroborate the vulner...
Remote IIS 5.x and IIS 6.0 Server Name Spoof
Remote IIS 5.x and IIS 6.0 Server Name Spoof It is possible to remotely spoof the "SERVERNAME" Microsoft® Internet Information Server® 5.0, 5.1 and 6.0 server variable by doing a modified HTTP request. Thus potentially revealing sensitive ASP code through the IIS 500-100.asp error page, the spoof...
CVE-2001-1511
The CVE-2001-1511 issue affects JRun 3.0/3.1 running on JRun Web Server (JWS) and IIS, where remote attackers can read arbitrary JSP source code by requesting a URL containing a source filename ending in jsp%00 or js%2570. This indicates a file-disclosure vulnerability enabling access to server-s...
CVE-2005-2008
CVE-2005-2008 affects Yaws Webserver 1.55 and earlier. A remote attacker can obtain the source code of yaw scripts by requesting a .yaws script with a trailing %00 (null). The root cause is a null-byte handling issue in script requests. Impact is information disclosure of script source; no integr...
