141 matches found
CVE-2004-2763
The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are vulnerable to cross-site scripting...
CVE-2004-2763
The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are vulnerable to cross-site scripting...
CVE-2004-2763: Undefined Security Weakness
The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are vulnerable to cross-site scripting...
HTTP Options Detection
Display available HTTP options for each system This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Options Detection', 'Description' = 'Display available HTTP options for each system', 'Author...
CVE-2003-1567
The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the original request content in the response body. This allows remote attackers to read HTTP headers, potentially leading to the theft of cookies and authentication credentials , or the bypass of the HttpOn...
SOL2452 - Vulnerabilities in the HTTP TRACE method - VU#867593
Note: Versions that are not listed in this Solution have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to SOL4602: Overview of F5 security vulnerability respons...
http-trace NSE Script
Sends an HTTP TRACE request and shows if the method TRACE is enabled. If debug is enabled, it returns the header fields that were modified in the response. Script Arguments http-trace.path Path to URI slaxml.debug See the documentation for the slaxml library. http.host, http.max-body-size,...
CVE-2005-4874
The XMLHttpRequest object in Mozilla 1.7.8 supports the HTTP TRACE method, which allows remote attackers to obtain 1 proxy authentication passwords via a request with a "Max-Forwards: 0" header or 2 arbitrary local passwords on the web server that hosts this object...
CVE-2005-4874
The vulnerability CVE-2005-4874 affects the XMLHttpRequest object in Mozilla 1.7.8, where the HTTP TRACE method can be abused to disclose credentials. Specifically, an attacker can obtain (1) proxy authentication passwords via a request with Max-Forwards: 0 and (2) arbitrary local passwords on th...
CVE-2005-4874: Improper Control of Generation of Code
The XMLHttpRequest object in Mozilla 1.7.8 supports the HTTP TRACE method, which allows remote attackers to obtain 1 proxy authentication passwords via a request with a "Max-Forwards: 0" header or 2 arbitrary local passwords on the web server that hosts this object...
Mbedthis AppWeb HTTP TRACE信息泄露漏洞
Mbedthis AppWeb是一款WEB应用服务程序。 Mbedthis AppWeb处理HTTP TRACE请求存在问题，远程攻击者可以利用漏洞获得敏感信息。 目前没有详细漏洞细节提供。 Mbedthis AppWeb 2.2.1 升级到Mbedthis AppWeb 2.2.2版本： http://www.mbedthis.com/...
Cross site scripting
Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing XST attacks, a related issue to CVE-2004-2320 and CVE-2005-3398...
CVE-2007-3008
Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing XST attacks, a related issue to CVE-2004-2320 and CVE-2005-3398...
CVE-2007-3008
CVE-2007-3008 affects Mbedthis AppWeb prior to 2.2.2. The vulnerability is that HTTP TRACE is enabled, which can lead to information leakage and cross-site tracing (XST) concerns. This entry is corroborated by related advisories in the connected documents, which note the TRACE method as the root ...
CVE-2007-3008
Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing XST attacks, a related issue to CVE-2004-2320 and CVE-2005-3398...
CVE-2007-3008: Improper Neutralization of Input During Web Page Generation
Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing XST attacks, a related issue to CVE-2004-2320 and CVE-2005-3398...
CVE-2006-6436
Cross-site scripting XSS vulnerability in the Network controller in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to inject arbitrary web script or HTML via HTTP TRACE messages...
CVE-2006-6436
Cross-site scripting XSS vulnerability in the Network controller in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to inject arbitrary web script or HTML via HTTP TRACE messages...
CVE-2006-6436: Undefined Security Weakness
Cross-site scripting XSS vulnerability in the Network controller in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to inject arbitrary web script or HTML via HTTP TRACE messages...