3890 matches found
CVE-2002-1453
Cross-site scripting XSS vulnerability in MyWebServer 1.0.2 allows remote attackers to insert script and HTML via a long request followed by the malicious script, which is echoed back to the user in an error message...
CVE-2002-1527
emumail.cgi in EMU Webmail 5.0 allows remote attackers to determine the full pathname for emumail.cgi via a malformed string containing script, which generates a regular expression matching error that includes the pathname in the resulting error message...
QPopper timing attack
Differet timing interval are used for error message in case of wrong username and wrong password...
eject 2.0.10 vulnerability
Application: eject Version: 2.0.10 Platforms: Linux Distribution: SuSE 7.3, most likely other versions of SuSE Linux as well also all distributions that make eject SUID root Bugs: verbose error messages reveal location of files/directories Risk: low Author: nordi e-mail: [email protected] 1...
Sage 1.0 Beta 3 - Content Management System Full Path Disclosure
source: https://www.securityfocus.com/bid/6893/info Sage Content Management System contains a path disclosure vulnerability. When a request is made for a module that does not exist, the returned error message contains the full path to the Sage installation directory. Disclosed path information...
Sage 1.0 Beta 3 - Content Management System Full Path Disclosure
Sage 1.0 Beta 3 - Content Management System Full Path Disclosure source: https://www.securityfocus.com/bid/6893/info Sage Content Management System contains a path disclosure vulnerability. When a request is made for a module that does not exist, the returned error message contains the full path ...
Oracle 9iAS Nonexistent .jsp File Request Error Message Path Disclosure
Oracle 9iAS allows remote attackers to obtain the physical path of a file under the server root via a request for a nonexistent .JSP file. The default error generated leaks the pathname in an error message. %NASLMINLEVEL 70300 This script was written by Javier Fernandez-Sanguino This software is...
Opera 7.0 - Error Message History Disclosure
Opera 7.0 - Error Message History Disclosure source: https://www.securityfocus.com/bid/6759/info It has been reported that Opera fails to ensure that a remote site has proper authorization before executing some methods used to access error messages stored in the Opera console. This issue is furth...
TOPO 1.41 - Full Path Disclosure
TOPO 1.41 - Full Path Disclosure source: https://www.securityfocus.com/bid/6768/info It has been reported that TOPo may return information to users that is sensitive in nature. Under some circumstances, it is possible to produce an error message that reveals information about web directory...
Opera 7.0 - Error Message History Disclosure
source: https://www.securityfocus.com/bid/6759/info It has been reported that Opera fails to ensure that a remote site has proper authorization before executing some methods used to access error messages stored in the Opera console. This issue is further exacerbated by the fact that error message...
Sniffing Opera's Tracks (GM#006-OP)
GreyMagic Security Advisory GM006-OP ===================================== By GreyMagic Software, Israel. 04 Feb 2003. Available in HTML format at http://security.greymagic.com/adv/gm006-op/. Topic: Sniffing Opera's Tracks. Discovery date: 29 Jan 2003. Affected applications: =====================...
TOPO 1.41 - Full Path Disclosure
source: https://www.securityfocus.com/bid/6768/info It has been reported that TOPo may return information to users that is sensitive in nature. Under some circumstances, it is possible to produce an error message that reveals information about web directory structure. This could result in more...
ical 3.7 remote dos
hi iCal http://www.brownbearsw.comis a web-based calendar that can be used to show meetings, events, or other schedules. calendars can be viewed, edited, and administered totally through the web. iCal is build for thin-clients, so access calendar without any plug-ins or java interpreters. I found...
CVE-2002-2008
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message...
CVE-2002-1728
askSam Web Publisher 1.0 and 4.0 allows remote attackers to determine the full path to the web root directory via a request for a file that does not exist, which generates an error message that reveals the full path...
CVE-2002-2045
xstatadmin.php in x-stat 2.3 and earlier allows remote attackers to 1 execute PHP commands such as phpinfo or 2 obtain the full path of the web server via an invalid action parameter, which leaks the pathname in an error message...
CVE-2002-1822
IBM HTTP Server 1.0 on AS/400 allows remote attackers to obtain the path to the web root directory and other sensitive information, which is leaked in an error mesage when a request is made for a non-existent Java Server Page JSP...
CVE-2002-1837
The getAlbumToDisplay function in idsShared.pm for Image Display System IDS 0.81 allows remote attackers to determine the existence of arbitrary directories via ".." sequences in the album parameter, which generates different error messages depending on whether the directory exists or not...