2801 matches found
W3C CERN HTTPd 3.0 Proxy - Cross-Site Scripting
W3C CERN HTTPd 3.0 Proxy - Cross-Site Scripting source: https://www.securityfocus.com/bid/5447/info CERN httpd is a freely available HTTP server and HTTP proxy server available from the W3C. The httpd Proxy is vulnerable to a cross site scripting attack. The condition is present because of the wa...
Crossite scripting in Falcon
HTML symbols are not filtered in error messages...
BlueFace Falcon Web Server 2.0 - Error Message Cross-Site Scripting
source: https://www.securityfocus.com/bid/5435/info Falcon Webserver does not sufficiently sanitize HTML tags from error message output. In particular, attackers may inject HTML into 301 and 404 error pages. It is possible to create a malicious link to the server which will generate an error page...
CVE-2002-0704
The Network Address Translation NAT capability for Netfilter "iptables" 1.2.6a and earlier leaks translated IP addresses in ICMP error messages...
PT-2002-1727 · Netfilter · Netfilter
Name of the Vulnerable Software and Affected Versions: Netfilter "iptables" versions 1.2.6a and earlier Description: The Network Address Translation NAT capability leaks translated IP addresses in ICMP error messages. Recommendations: For versions 1.2.6a and earlier, consider disabling the NAT...
CVE-2001-1084
Cross-site scripting vulnerability in Allaire JRun 3.0 and 2.3.3 allows a malicious webmaster to embed Javascript in a request for a .JSP, .shtml, .jsp10, .jrun, or .thtml file that does not exist, which causes the Javascript to be inserted into an error message...
CVE-2002-0266
Thunderstone Texis CGI script allows remote attackers to obtain the full path of the web root via a request for a nonexistent file, which generates an error message that includes the full pathname...
CVE-2002-0253
PHP, when not configured with the "displayerrors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the include directive to fail, and...
CVE-2002-0208
PGP Security PGPfire 7.1 for Windows alters the system's TCP/IP stack and modifies packets in ICMP error messages in a way that allows remote attackers to determine that the system is running PGPfire...
CVE-2002-0212
The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existence of valid usernames and makes it easier to conduct a brute force attack...
CVE-2002-0208
PGP Security PGPfire 7.1 for Windows alters the system's TCP/IP stack and modifies packets in ICMP error messages in a way that allows remote attackers to determine that the system is running PGPfire...
CVE-2001-0987
Cross-site scripting vulnerability in CGIWrap before 3.7 allows remote attackers to execute arbitrary Javascript on other web clients by causing the Javascript to be inserted into error messages that are generated by CGIWrap...
Microsoft IIS 4.05.05.1 - Authentication Method Disclosure
Microsoft IIS 4.05.05.1 - Authentication Method Disclosure source: https://www.securityfocus.com/bid/4235/info Microsoft IIS supports Basic and NTLM authentication. Reportedly, the authentication methods supported by a given IIS server can be revealed to an attacker through the inspection of...
PT-2001-2613 · Amtote International · Amtote International Homebet
Name of the Vulnerable Software and Affected Versions: AmTote International homebet program affected versions not specified Description: The issue allows remote attackers to determine the existence of valid account numbers via a brute force attack by analyzing different error messages returned fo...
CVE-2001-1437
easyScripts easyNews 1.5 allows remote attackers to obtain the full path of the web root via a view request with a non-integer news message id field, which leaks the path in a PHP error message when the script times out...
CVE-2001-0829
A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message...
Несанкционированный доступ в Homebet (unauthorized access)
Для авторизации пользователя применяется 4-х символьный pin-код. Сообщения об ошибке для неправильного пин-кода и имени пользователя различаются. Лог-файл содержащий всю информацию доступен через веб...
CVE-1999-1266
rsh daemon rshd generates different error messages when a valid username is provided versus an invalid name, which allows remote attackers to determine valid users on the system...
CVE-1999-1225
rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not...
