KPMG-2002033: Resin DOS device path disclosure

-------------------------------------------------------------------- Title: Resin DOS device path disclosure BUG-ID: 2002033 Released: 17th Jul 2002 -------------------------------------------------------------------- Problem: ======== It is possible to disclose the physical path to the webroot...

Apache Tomcat DOS Device Name XSS

Apache Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. By making requests for DOS Device names it is possible to cause Tomcat to throw an exception, allowing cross-site scripting attacks. The exception...

CVE-2002-0200

Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name...

CVE-2001-1249

vWebServer 1.2.0 allows remote attackers to cause a denial of service via a URL that contains MS-DOS device names...

Special DOS-device access in Microsoft Outlook Express

It's possible to hang Outlooks Express by using prn: device as a name for bgsound or iframe. It's also possible to send data to special device...

Physical path leakage in ColdFusion

Error message on access attempt to DOS device contains physical path...

CVE-2002-0106

BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name...

CVE-2001-0493

Small HTTP server 2.03 allows remote attackers to cause a denial of service via a URL that contains an MS-DOS device name such as aux...

CVE-2001-0696

NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service crash via a CD command to a directory with an MS-DOS device name such as con...

CVE-2001-0696

NetWin SurgeFTP 2.0a and 1.0b are affected by CVE-2001-0696: a remote attacker can cause a denial of service (crash) by issuing a CD command to a directory named with an MS-DOS device name (e.g., con). The available sources confirm the vulnerability exists and describe the impact as a crash/DoS, ...

CVE-2001-0558

CVE-2001-0558 affects Jana Webserver 2.01 beta 1 and earlier. A remote attacker can cause a denial of service by sending a URL request that includes an MS-DOS device name (e.g., GET /aux HTTP/1.0). Connected sources corroborate the DOS impact via MS-DOS device names; OpenVAS/Nessus references lis...

CVE-2001-0616

Faust Informatics Freestyle Chat server prior to 4.1 SR3 allows a remote attacker to create a denial of service via a URL request which includes a MS-DOS device name e.g., GET /aux HTTP/1.0...

BPM STUDIO PRO 4.2 DOS DEVICE PATH VULNERABILITY

Hi Bugtraq !! BPM STUDIO PRO 4.2 is one of the most famous mp3 mixer and player and it has an http server implementation for manage the player via the web browser. Unfortunatly, when you perform a simple http request like: http://BPM-HOST/con/con you can crash instantly non-patched Win9x host wit...

CVE-2001-0703

tradecli.dll in Arcadia Internet Store 1.0 allows a remote attacker to cause a denial of service via a URL request with an MS-DOS device name in the template parameter...

CVE-2001-0696

NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service crash via a CD command to a directory with an MS-DOS device name such as con...

CVE-2001-0703

tradecli.dll in Arcadia Internet Store 1.0 allows a remote attacker to cause a denial of service via a URL request with an MS-DOS device name in the template parameter...

CVE-2001-0558

T. Hauck Jana Webserver 2.01 beta 1 and earlier allows a remote attacker to create a denial of service via a URL request which includes a MS-DOS device name i.e. GET /aux HTTP/1.0...

CVE-2001-1249

vWebServer 1.2.0 allows remote attackers to cause a denial of service via a URL that contains MS-DOS device names...

CVE-2001-0493

Small HTTP server 2.03 allows remote attackers to cause a denial of service via a URL that contains an MS-DOS device name such as aux...

Faust Informatics FreeStyle Chat 4.1 SR2 MS-DOS Device Name - Denial of Service

Faust Informatics FreeStyle Chat 4.1 SR2 MS-DOS Device Name - Denial of Service source: https://www.securityfocus.com/bid/2777/info A problem with the chat server makes it possible to deny service to legitmate users. By submitting a request to the webserver including the 'AUX' MS-DOS device name,...