XOOPS 2.0 XoopsOption - Information Disclosure

source: https://www.securityfocus.com/bid/7149/info XOOPS has been reported vulnerable to an information disclosure vulnerability. According to the report, path information and other sensitive data may be output in server error messages. Information obtained in this manner may be used by an...

XOOPS 2.0 XoopsOption - Information Disclosure

XOOPS 2.0 XoopsOption - Information Disclosure source: https://www.securityfocus.com/bid/7149/info XOOPS has been reported vulnerable to an information disclosure vulnerability. According to the report, path information and other sensitive data may be output in server error messages. Information...

CVE-2002-1416

The POP3 service for WebEasyMail 3.4.2.2 and earlier generates diffferent error messages for valid and invalid usernames during authentication, which makes it easier for remote attackers to conduct brute force attacks...

MyABraCaDaWeb 1.0 - Full Path Disclosure

MyABraCaDaWeb 1.0 - Full Path Disclosure source: https://www.securityfocus.com/bid/7126/info MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This information could be useful in further attacks against a system hosting the software...

MyABraCaDaWeb 1.0 - Full Path Disclosure

source: https://www.securityfocus.com/bid/7126/info MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This information could be useful in further attacks against a system hosting the software. http://www.example.com/index.php?IDAdmin=tes...

CVE-2002-2410

openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information...

CVE-2002-2007

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages JSP in the 1 test/jsp, 2 samples/jsp and 3 examples/jsp directories, or the 4...

CVE-2002-1982

Directory traversal vulnerability in the listdirectory function in Icecast 1.3.12 allows remote attackers to determine if a directory exists via a .. dot dot in the GET request, which returns different error messages depending on whether the directory exists or not...

Multiple Mambo Site Server sec-weaknesses

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: Multiple Mambo Site Server sec-weaknesses product: Mambo Site Server 4.0.11 vendor: http://sourceforge.org/projects/mambo risk: high date: 12/12/2k2 discovered by: euronymous /F0KP /HACKRU Team advisory urls:...

XSS and Path Disclosure in UPB

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: XSS and Path Disclosure in UPB product: Ultimate PHP Board UPB final beta 1.0 vendor: http://www.webrc.ca/php/upb.php risk: middle date: 12/7/2k2 discovered by: euronymous /F0KP /HACKRU Team advisory url: http://f0kp.iplus.ru/bz/009.txt...

CVE-2002-0921

CGIScript.net csNews.cgi allows remote attackers to obtain potentially sensitive information, such as the full server pathname and other configuration settings, via the viewnews command with an invalid database, which leaks the information in error messages...

Aestiva HTML/OS 2.4 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/5618/info Aestiva HTML/OS is a database engine and development suite for building websites and web-based software products. HTML/OS does not sufficiently sanitize metacharacters from error message output. In particular, attackers may inject HTML into erro...

CVE-2002-0918

CGIScript.net csPassword.cgi leaks sensitive information such as the pathname of the server in debug messages that are presented when the script fails, which allows remote attackers to obtain the information via a "remove" option in the command parameter, which generates an error...

CVE-2002-0921

CGIScript.net csNews.cgi allows remote attackers to obtain potentially sensitive information, such as the full server pathname and other configuration settings, via the viewnews command with an invalid database, which leaks the information in error messages...

Proxy error messages crossite scripting

In error message URL is not escaped, it makes it possible to inject javascript into URL...

Advisory: Bonsai XSS and Physical Path Revealing Vulnerabilities

Author: Stan Bubrouski Date: 19 August 2002 Product: Bonsai Versions Affected: AllCurrent and CVS all vulnerable Severity: Cross Site Scripting is possible in several places due to a lack of stripping of tags from input. Some error messages also contain CSS and reveal the physical path of the...

CVE-2002-0810

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails...

W3C CERN HTTPd 3.0 Proxy - Cross-Site Scripting

W3C CERN HTTPd 3.0 Proxy - Cross-Site Scripting source: https://www.securityfocus.com/bid/5447/info CERN httpd is a freely available HTTP server and HTTP proxy server available from the W3C. The httpd Proxy is vulnerable to a cross site scripting attack. The condition is present because of the wa...

Crossite scripting in Falcon

HTML symbols are not filtered in error messages...

BlueFace Falcon Web Server 2.0 - Error Message Cross-Site Scripting

source: https://www.securityfocus.com/bid/5435/info Falcon Webserver does not sufficiently sanitize HTML tags from error message output. In particular, attackers may inject HTML into 301 and 404 error pages. It is possible to create a malicious link to the server which will generate an error page...