YaBB 1 - Invalid Topic Error Page Cross-Site Scripting

YaBB 1 - Invalid Topic Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/5078/info It is reported possible for attackers to construct a URL that will cause scripting code to be embedded in error pages. YaBB fails to check URLs for the presence of script commands when...

IBM WebSphere Traversal Error Page XSS

The remote web server seems to be vulnerable to cross-site scripting attacks because it fails to sanitize input supplied as a filename when displaying an error page. The vulnerability would allow an attacker to make the server present the user with the attacker's JavaScript/HTML code. Since the...

ServletExec 4.1 ISAPI com.newatlanta.servletexec.JSP10Servlet Path Disclosure

By requesting a nonexistent .JSP file, or by invoking the JSPServlet directly and supplying no filename, it is possible to make the ServletExec ISAPI filter disclose the physical path of the webroot. %NASLMINLEVEL 70300 This script was written by Matt Moore Script audit and contributions from...

ACME Labs thttpd 2.20 - Cross-Site Scripting

ACME Labs thttpd 2.20 - Cross-Site Scripting source: https://www.securityfocus.com/bid/4601/info thttpd is a web server product maintained by ACME Labs. thttpd has been compiled for Linux, BSD and Solaris, as well as other Unix like operating systems. Cross Site Scripting issues has been reported...

Microsoft Internet Information Server (IIS) contains cross-site scripting vulnerability in HTTP error page results

Overview Visitors to web sites that use Microsoft IIS and also use the default error pages are vulnerable to cross-site scripting attacks. Description Cross-site scripting is a form of attack in which an intruder leverages the trust between a victim and a web-site the victim trusts. Quoting from...

Microsoft IIS 4.0/5.0 - HTTP Error Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/4486/info A Cross Site Scripting issue exists in some versions of IIS. The HTTP Error Page created by IIS may, under some circumstances, contain HTML content which includes unsanitized user supplied input. An attacker may construct a link to a vulnerable...

Microsoft IIS 4.05.0 - HTTP Error Page Cross-Site Scripting

Microsoft IIS 4.05.0 - HTTP Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/4486/info A Cross Site Scripting issue exists in some versions of IIS. The HTTP Error Page created by IIS may, under some circumstances, contain HTML content which includes unsanitized user...

Thunderstone TEXIS 3.0 - Full Path Disclosure

source: https://www.securityfocus.com/bid/4035/info A vulnerability in TEXIS allows an attacker to view the full path to the web root. If the attacker submits an HTTP request for an invalid path, the server will return an error page containing the path to the web root. System information may also...

Thunderstone TEXIS 3.0 - Full Path Disclosure

Thunderstone TEXIS 3.0 - Full Path Disclosure source: https://www.securityfocus.com/bid/4035/info A vulnerability in TEXIS allows an attacker to view the full path to the web root. If the attacker submits an HTTP request for an invalid path, the server will return an error page containing the pat...

CVE-2001-0947

The CVE-2001-0947 issue affects ValiCert Enterprise Validation Authority (EVA) versions 3.3 through 4.2.1. It allows remote attackers to determine the server’s real pathname by requesting an invalid extension, which causes an error page that reveals the path. The vulnerability is a server-path di...

CVE-2001-0947

Forms.exe CGI program in ValiCert Enterprise Validation Authority EVA 3.3 through 4.2.1 allows remote attackers to determine the real pathname of the server by requesting an invalid extension, which produces an error page that includes the path...

Plumtree Corporate Portal Cross-Site Scripting (Patch Available)

Plumtree Corporate Portal Cross-Site Scripting Patch Available ---------------------------------------------------------------- SYNOPSIS Plumtree www.plumtree.com Corporate Portal versions 4.5, 4.0, 4.0SP1, 4.0i, 4.0iSP1, and 3.5 should be modified to remediate potential cross-site scripting...

CVE-2001-1202

Cross-site scripting vulnerability in DeleGate 7.7.0 and 7.7.1 does not quote scripting commands within a "403 Forbidden" error page, which allows remote attackers to execute arbitrary Javascript on other clients via a URL that generates an error...

DeleGate 7.7.1 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/3749/info DeleGate is a proxy server which runs on Linux , Unix, Microsoft Windows and OS/2 platforms. It is capable of translating a number of protocolsHTTP, FTP, NNTP, POP, Telnet, etc. between client and server. DeleGate is prone to cross-site scriptin...

CVE-2001-0947

Forms.exe CGI program in ValiCert Enterprise Validation Authority EVA 3.3 through 4.2.1 allows remote attackers to determine the real pathname of the server by requesting an invalid extension, which produces an error page that includes the path...

CVE-2001-0824

Cross-site scripting vulnerability in IBM WebSphere 3.02 and 3.5 FP2 allows remote attackers to execute Javascript by inserting the Javascript into 1 a request for a .JSP file, or 2 a request to the webapp/examples/ directory, which inserts the Javascript into an error page...

Jakarta Tomcat 3.x4.0 - Error Message Information Disclosure

Jakarta Tomcat 3.x4.0 - Error Message Information Disclosure source: https://www.securityfocus.com/bid/3199/info When a malformed request is made for a Java Server Page the server displays an error page. The error page contains potentially sensitive information, along with the absolute path of th...

Lotus Domino Server R5 vulnerable to Cross-Site Scripting via passing of user input directly to default error page

Overview Lotus Domino R5 Servers are vulnerable to a cross-site scripting vulnerability. A web site may inadvertently include malicious HTML tags or scriptJavaScript, VBScript, Java, etc. in a dynamically generated page based on unvalidated input from untrustworthy sources. This can be a problem...

Netscape PublishingXPert 2.02.22.5 - Local File Reading

Netscape PublishingXPert 2.02.22.5 - Local File Reading // source: https://www.securityfocus.com/bid/2920/info Netscape PublishingXpert is an e-commerce application distributed by Netscape. PublishingXpert manages user information, sending them special ads and personalized content. PSCOErrPage.ht...