2371 matches found
Syscall implementation could lead to whether or not a file exists
include stdlib.h include unistd.h include stdio.h include sys/types.h include fcntl.h ifndef ONOFOLLOW define ONOFOLLOW 0400000 / don't follow links / endif ifndef OLARGEFILE define OLARGEFILE 0100000 endif int flags = ORDONLY|OEXCL|OSYNC|ONOCTTY|ONOFOLLOW; / taken from scuts format string...
Syscall timing attacks in multiple systems
By timing system calls it's possible to check file existance...
Linux Kernel 2.2.x2.4.x - IO System Call File Existence
Linux Kernel 2.2.x2.4.x - IO System Call File Existence / source: https://www.securityfocus.com/bid/7279/info A weakness has been discovered on various systems that may result in an attacker gaining information pertaining to the existence of inaccessible files. The problem lies in the return time...
Linux Kernel 2.2.x/2.4.x - I/O System Call File Existence
/ source: https://www.securityfocus.com/bid/7279/info A weakness has been discovered on various systems that may result in an attacker gaining information pertaining to the existence of inaccessible files. The problem lies in the return times when attempting to access existent and non-existent...
CVE-2002-0594
CVE-2002-0594 affects Netscape 6 and Mozilla 1.0 RC1 and earlier. A CSS LINK element that triggers an HTTP redirect can let remote attackers determine the existence of local files, exposing partial confidentiality. The CVSS v2 base score is 5.0 (Network, Low complexity, No user interaction). Red ...
CVE-2002-0355: Undefined Security Weakness
netstat in SGI IRIX before 6.5.12 allows local users to determine the existence of files on the system, even if the users do not have the appropriate permissions...
qpopper timing analysis on to determine if a username exists on a system
Hello, during development of a pop3 tool I found an issue that makes it possible for any user to check the validity of a user on a target system. If a user is valid and an invalid password has been supplied, then the system waits 10 seconds until it sends a disconnect message and disconnect. If t...
CVE-2002-1339
CVE-2002-1339 affects the Spreadsheet component of Office Web Components (OWC) 10. The XMLURL property follows redirections, enabling remote attackers to infer the existence of local files from error responses or to read Worksheet XML files. The provided sources confirm the vulnerability descript...
CVE-2002-1338
The Load method in the Chart component of Office Web Components OWC 9 and 10 generates an exception when a specified file does not exist, which allows remote attackers to determine the existence of local files...
CVE-2002-1340: Undefined Security Weakness
The "ConnectionFile" property in the DataSourceControl component in Office Web Components OWC 10 allows remote attackers to determine the existence of local files by detecting an exception...
SUIDPerl 5.6 - Information Disclosure
source: https://www.securityfocus.com/bid/6282/info An information disclosure vulnerability has been reported for SuidPerl. Reportedly, it is possible for an attacker to determine whether files exist in non-accessible directories. An attacker can exploit this vulnerability by invoking suidperl wi...
SUIDPerl 5.6 - Information Disclosure
SUIDPerl 5.6 - Information Disclosure source: https://www.securityfocus.com/bid/6282/info An information disclosure vulnerability has been reported for SuidPerl. Reportedly, it is possible for an attacker to determine whether files exist in non-accessible directories. An attacker can exploit this...
Microsoft Office Web Components allows arbitary user to determine whether local file exists via Chart component "Load" method
Overview Microsoft Office Web Components OWC allows a malicious script on a web page to learn if a file exists on the client's filesystem. Description OWC allows viewing of Microsoft Office documents such as spreadsheets and charts to be viewed within an HTML document in Microsoft Internet Explor...
CVE-2002-0500
Internet Explorer 5.0 through 6.0 allows remote attackers to determine the existence of files on the client via an IMG tag with a dynsrc property that references the target file, which sets certain elements of the image object such as file size...
Image Display System 0.8.1 - Directory Existence Disclosure
source: https://www.securityfocus.com/bid/4870/info IDS Image Display System is an web based photo album application written in Perl. IDS is freely available and is maintained by Ashley M. Kirchner. Users can confirm the existence and location of various directories residing on the IDS host. This...
Image Display System 0.8.1 - Directory Existence Disclosure
Image Display System 0.8.1 - Directory Existence Disclosure source: https://www.securityfocus.com/bid/4870/info IDS Image Display System is an web based photo album application written in Perl. IDS is freely available and is maintained by Ashley M. Kirchner. Users can confirm the existence and...
Multiple bugs in hostingcontroller
Different error message on wrong user name and password makes it possible to check account existance. Directory traversal allows to access files outside web root...
Получение списка пользователей в Lotus Domino (information leakage)
Если пользователь существует, то HTTP-запрос GET /mail/USER.nsf даст успешный ответ, если не существует - то неуспешный...
Serious IE privacy issues
In addition to "Minor IE System Info Disclosure" Nov 4 2001 I've found that you can further poll a system for ANY file, provided you know it's path. Use the following script: html head script language="javascript" !-- var fileExists = false; function yes alert"the file exists."; yes = true;...
CVE-2001-1483
One-Time Passwords In Everything a.k.a OPIE 2.32 and 2.4 allows remote attackers to determine the existence of user accounts by printing random passphrases if the user account does not exist and static passphrases if the user account does exist...