Serious IE privacy issues

In addition to "Minor IE System Info Disclosure" Nov 4 2001 I've found that you can further poll a system for ANY file, provided you know it's path. Use the following script: html head script language="javascript" !-- var fileExists = false; function yes alert"the file exists."; yes = true;...

CVE-1999-1110

Windows Media Player ActiveX object as used in Internet Explorer 5.0 returns a specific error code when a file does not exist, which allows remote malicious web sites to determine the existence of files on the client...

CVE-1999-1496

Sudo 1.5 in Debian Linux 2.1 and Red Hat 6.0 allows local users to determine the existence of arbitrary files by attempting to execute the target filename as a program, which generates a different error message when the file does not exist...

CVE-1999-1225

rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not...

CVE-1999-1110: Undefined Security Weakness

Windows Media Player ActiveX object as used in Internet Explorer 5.0 returns a specific error code when a file does not exist, which allows remote malicious web sites to determine the existence of files on the client...

EFTP Server 2.0.7.337 - Directory Existence / File Existence

source: https://www.securityfocus.com/bid/3333/info A user can confirm the existence and location of files and directory structure information, by submitting a 'size' or 'mdtm' command of a file. If the command is carried out by the vulnerable service, the attacker can confirm the location of the...

CVE-1999-1496: Undefined Security Weakness

Sudo 1.5 in Debian Linux 2.1 and Red Hat 6.0 allows local users to determine the existence of arbitrary files by attempting to execute the target filename as a program, which generates a different error message when the file does not exist...

EFTP Server 2.0.7.337 - Directory Existence File Existence

EFTP Server 2.0.7.337 - Directory Existence File Existence source: https://www.securityfocus.com/bid/3333/info A user can confirm the existence and location of files and directory structure information, by submitting a 'size' or 'mdtm' command of a file. If the command is carried out by the...

CVE-1999-1225: Undefined Security Weakness

rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not...

Lotus Notes Java VM leaks file existence through timing difference in ECLs

Overview Lotus Notes JVM leaks information about the existence of a file. Description A malicious Java applet run in the Lotus Notes web browser can determine if a local file exists. Notes' preferences must be set to browse the web using the Notes browser, with execution of Java applets...

@stake Security Advisory: G6 FTP File Existence Disclosure and Netbios Hash Retrieval (A040301-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Notification Advisory Name: G6 FTP File Existence Disclosure and Netbios Hash Retrieval Release Date: 04/03/2001 Application: G6 FTP Server v2.0 exploit and example, other applications vulnerable to Netbi...

Gene6 BPFTP Server 2.0 - File Existence Disclosure

Gene6 BPFTP Server 2.0 - File Existence Disclosure source: https://www.securityfocus.com/bid/2537/info A user can confirm the existence and location of files and directory structure information, by submitting a 'size' or 'mdtm' command of a file. If the command is carried out by the vulnerable...

Gene6 BPFTP Server 2.0 - File Existence Disclosure

source: https://www.securityfocus.com/bid/2537/info A user can confirm the existence and location of files and directory structure information, by submitting a 'size' or 'mdtm' command of a file. If the command is carried out by the vulnerable service, the attacker can confirm the location of the...

CVE-2000-1117

The Extended Control List ECL feature of the Java Virtual Machine JVM in Lotus Notes Client R5 allows malicious web site operators to determine the existence of files on the client by measuring delays in the execution of the getSystemResource method...

CVE-2000-1177

bb-hist.sh, bb-histlog.sh, bb-hostsvc.sh, bb-rep.sh, bb-replog.sh, and bb-ack.sh in Big Brother BB before 1.5d3 allows remote attackers to determine the existence of files and user ID's by specifying the target file in the HISTFILE parameter...

CVE-2000-1177

CVE-2000-1177 affects Big Brother (BB) prior to 1.5d3, where several scripts (bb-hist.sh, bb-histlog.sh, bb-hostsvc.sh, bb-rep.sh, bb-replog.sh, bb-ack.sh) allow remote attackers to determine whether files exist and deduce user IDs by passing a target filename in HISTFILE. The entry bases impact ...

CVE-2000-1117

The Extended Control List ECL feature of the Java Virtual Machine JVM in Lotus Notes Client R5 allows malicious web site operators to determine the existence of files on the client by measuring delays in the execution of the getSystemResource method...

Security Hole in ECL Feature of Java VM Embedded in Lotus Notes Client R5

========================================================================= Security Hole in ECL Feature of Java VM Embedded in Lotus Notes Client R5 http://java-house.etl.go.jp/ml/archive/j-h-b/038904.html ========================================================================= The security hole...

Lotus Notes Client R5 File Existence Verification Vulnerability

Description Lotus Notes Client R5 is a messaging and collaboration tool that contains a built in web browser. The web browser implements a Java Virtual Machine VM designed specifically for Lotus Notes. A security vulnerability exists in the Execution Control List ECL feature within the Java VM th...

BB4 Big Brother Network Monitor 1.5 d2 - 'bb-hist.sh?HISTFILE' File Existence Disclosure

source : https://www.securityfocus.com/bid/1971/info Big Brother Network Monitor is a robust, feature rich network monitoring package produced by BB4 Technologies. A problem exists that can allow remote account guessing. The problem occurs in the Common Gateway Interface package included with Big...