CVE-2007-1770

Buffer overflow in the ArcSDE service giomgr in Environmental Systems Research Institute ESRI ArcGIS before 9.2 Service Pack 2, when using three tiered ArcSDE configurations, allows remote attackers to cause a denial of service giomgr crash and execute arbitrary code via long parameters in crafte...

NetProxy <= 4.03 Web Filter Evasion / Bypass Logging Exploit

No description provided by source. !/usr/bin/perl Application: NetProxy 4.03 http://www.grok.co.uk/netproxy/index.html Description: NetProxy includes a powerful web cache to boost performance and reduce online costs. There is also an application-level firewall to protect your network from unwante...

CVE-2006-6303

CVE-2006-6303 affects Ruby’s CGI module (read_multipart) where boundaries in MIME multipart content aren’t detected correctly, allowing remote attackers to trigger an infinite loop and cause a denial of service. The issue is in Ruby before 1.8.5-p2; Oracle Linux/RH advisories backported fixes and...

Another DoS Vulnerability in CGI Library

The readmultipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service infinite loop via crafted HTTP requests, a different issue than CVE-2006-5467...

Design/Logic Flaw

The HTTP service in EServ/3 3.25 allows remote attackers to obtain sensitive information via crafted HTTP requests containing dot, space, and slash characters, which reveals the source code of script files...

CVE-2006-2309

The CVE-2006-2309 issue affects EServ/3.25 HTTP server where crafted requests containing dot, space, and slash characters can disclose the source code of script files. Secunia reports directory traversal and filename-extension validation flaws enabling disclosure; affected software is EServ/3 ver...

CVE-2006-2248

Xeneo Web Server 2.2.22.0 allows remote attackers to obtain the source code of script files via crafted requests containing dot, space, and slash characters in the file extension...

Design/Logic Flaw

Xeneo Web Server 2.2.22.0 allows remote attackers to obtain the source code of script files via crafted requests containing dot, space, and slash characters in the file extension...

CVE-2006-2248

Xeneo Web Server 2.2.22.0 allows remote attackers to obtain the source code of script files via crafted requests containing dot, space, and slash characters in the file extension...

CVE-2006-1598

Summary: CVE-2006-1598 affects AN HTTPD 1.42n and possibly earlier versions (before 1.42p). Vulnerability: Remote attackers can obtain the source code of scripts by sending crafted requests that exploit specific dot and space characters in the file extension. Impact: Information disclosure (confi...

CVE-2006-1598

AN HTTPD 1.42n, and possibly other versions before 1.42p, allows remote attackers to obtain source code of scripts via crafted requests with 1 dot and 2 space characters in the file extension...

lighttpd on Windows < 1.4.10a Crafted Filename Request Script Source Disclosure

According to its banner, the version of lighttpd running on the remote Windows host is prior to 1.4.10a. It is, therefore, affected by an information disclosure vulnerability due to a failure to properly validate filename extensions in URLs. A remote attacker can exploit this issue, via specially...

Pubcookie application server modules contain cross-site scripting vulnerabilities

Overview Cross-site scripting vulnerabilities in the Pubcookie application server modules could allow a remote attacker to gain access to sensitive information. Description Pubcookie is a software package that provides intra-institutional single-sign-on authentication for end-users over the web...

Code injection

RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving 1 "." dot, 2 space, and 3 "/" slash characters...

CVE-2006-0949

RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving 1 "." dot, 2 space, and 3 "/" slash characters...

RaidenHTTPD Crafted Request Script Source Disclosure

The remote host is running RaidenHTTPD, a web server for Windows. According to its banner, the version of RaidenHTTPD installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue to disclose the source of scripts...

Design/Logic Flaw

NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service CPU consumption via crafted requests to Login.asp, possibly involving the 1 "In" and 2 "b;tnLogIn" parameters, or 3 malformed btnLogIn parameters, possibly involving missing "" open bracket or...

CVE-2006-0911

CVE-2006-0911 affects Ipswitch WhatsUp Professional 2006. The vulnerable component is NmService.exe handling requests to Login.asp. The underlying issue is triggered by crafted requests that use the parameters (1) "In]" and (2) "b;tnLogIn", or (3) malformed btnLogIn, potentially involving missing...

CVE-2006-0911

NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service CPU consumption via crafted requests to Login.asp, possibly involving the 1 "In" and 2 "b;tnLogIn" parameters, or 3 malformed btnLogIn parameters, possibly involving missing "" open bracket or...

[Full-disclosure] [ACSSEC-2005-11-25-0x3] FTGate 4.4 [Build 4.4.000 Oct 26 2005] Cr oss Site Scripting Vulnerability

-=+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++=- ACS Security Assessment Advisory - XSS Scripting Vulnerability ID: ACSSEC-2005-11-25 - 0x3 Class: Cross-Site-Scripting XSS Package: FTGate 4.4 Build 4.4.000 Oct 26 2005 Build: Windows NT/2k/XP/2k3 Notified: Dec 01, 2005 Released: Dec...