CVE-2000-0972

HP-UX 11.00 crontab allows local users to read arbitrary files via the -e option by creating a symlink to the target file during the crontab session, quitting the session, and reading the error messages that crontab generates...

CVE-2000-0972

HP-UX 11.00 crontab allows local users to read arbitrary files through the -e option by creating a symlink to the target file during the crontab session, then quitting and reading the error messages crontab generates. Affected software: HP-UX 11.00 crontab. Root cause: symlink exposure via cronta...

CVE-2000-1032

The client authentication interface for Check Point Firewall-1 4.0 and earlier generates different error messages for invalid usernames versus invalid passwords, which allows remote attackers to identify valid usernames on the firewall...

CVE-2000-1104

Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 CVE-2000-0746 allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those...

CVE-2000-1002

POP3 daemon in Stalker CommuniGate Pro 3.3.2 generates different error messages for invalid usernames versus invalid passwords, which allows remote attackers to determine valid email addresses on the server for SPAM attacks...

CVE-2000-1037

Check Point Firewall-1 session agent 3.0 through 4.1 generates different error messages for invalid user names versus invalid passwords, which allows remote attackers to determine valid usernames and guess a password via a brute force attack...

CVE-2000-1032

The client authentication interface for Check Point Firewall-1 4.0 and earlier generates different error messages for invalid usernames versus invalid passwords, which allows remote attackers to identify valid usernames on the firewall...

CVE-2000-1030

CS&T CorporateTime for the Web returns different error messages for invalid usernames and invalid passwords, which allows remote attackers to determine valid usernames on the server...

CVE-2000-1030

CS&T CorporateTime for the Web returns different error messages for invalid usernames and invalid passwords, which allows remote attackers to determine valid usernames on the server...

CVE-2000-1037

Check Point Firewall-1 session agent 3.0 through 4.1 generates different error messages for invalid user names versus invalid passwords, which allows remote attackers to determine valid usernames and guess a password via a brute force attack...

CVE-2000-1037

The CVE-2000-1037 issue affects Check Point Firewall-1 session agent versions 3.0 through 4.1. The root cause is that the service returns different error messages for invalid usernames versus invalid passwords, enabling remote attackers to enumerate valid usernames and perform brute-force passwor...

Re: Squid doesn't quote urls in error messages.

Hello Lincoln Yeoh, 27.10.00 13:47, you wrote: Squid doesn't quote urls in error messages.; L I noticed that Squid 2.3.STABLE4 doesn't quote urls in error L messages. skip L I haven't really tried it myself, and so I can't confirm if it really works L that's why it's in VULN-DEV ; . I can confirm...

CVE-2000-0759

Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path...

CVE-2000-0601

LeafChat 1.7 IRC client allows a remote IRC server to cause a denial of service by rapidly sending a large amount of error messages...

CVE-2000-0640

Guild FTPd allows remote attackers to determine the existence of files outside the FTP root via a .. dot dot attack, which provides different error messages depending on whether the file exists or not...

CVE-2000-0746

Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting CSS attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those...

Multiple QNX Voyager Issues

Tested Versions: QNX Voyager 2.01B Tested Distributions: QNX Demo Disk Modem v405 QNX Demo Disk Network v405 Distributor: QNX Software Systems Limited http://www.qnx.com Distributor Status: No response after 3 weeks Intro: QNX is a whole operating system aimed at the embedded computing market. Th...

DrPhibez and Nitro187 Guild FTPD 0.9.7 - File Existence Disclosure

DrPhibez and Nitro187 Guild FTPD 0.9.7 - File Existence Disclosure source: https://www.securityfocus.com/bid/1452/info Guild Ftpd will not send files outside of the ftp root when they are specified by the ../ string in the path of the GET request. However due to the difference in the error messag...

DrPhibez and Nitro187 Guild FTPD 0.9.7 - File Existence Disclosure

source: https://www.securityfocus.com/bid/1452/info Guild Ftpd will not send files outside of the ftp root when they are specified by the ../ string in the path of the GET request. However due to the difference in the error messages it is able to determine if the file requested exists. The error...

CVE-2000-0601

LeafChat 1.7 IRC client allows a remote IRC server to cause a denial of service by rapidly sending a large amount of error messages...