CVE-2001-1403: Undefined Security Weakness

Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading the information from the web server logs, or by "shoulder-surfing" and observing the web browser's location bar...

More OmniHTTPd Problems

I've discovered another vulnerability in one of the OmniHTTPd sample apps. This time, the culprit is "/cgi-bin/redir.exe". This app is vulnerable to a newline injection issue. The vulnerability occurs because the "URL" query parameter case sensitive is decoded and placed directly into the respons...

WHERE'S THE CA$H: Internet Explorer 6.00. Outlook Express 6.00

Saturday, July 27, 2002 Trivial lead-up to yet another silent delivery and installation of an executable on the target computer using Outlook Express 6. This can be achieved combining several past possibilities, specifically the following: http://www.securityfocus.com/bid/1033...

CVE-2002-0559: Undefined Security Weakness

Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via 1 a long help page request without a dadname, which overflows the resulting HTTP Location header, 2 a long HTTP request to the plsq...

Vulnerability in Apache Tomcat v3.23 & v3.24 (part 2)

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-06 Description: Tomcat realPath.jsp gives location of web root. Date: 8/1/2002 Application: Apache Tomcat Java server versions 3.23 and 3.24 Platform: Linux/Unix Severity: Remote attackers can obtain the location of webroot...

Vulnerability in Apache Tomcat v3.23 & v3.24 (part 3)

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-7 Description: Tomcat multiple sample files display webroot location on default configuration on request. Date: 8/1/2002 Application: Apache Tomcat java server v3.23, 3.24. Platform: Linux/Unix Severity: Remote attackers can obta...

Oracle9i Application Server Apache PL/SQL module vulnerable to buffer overflow via HTTP Location header

Overview A buffer overflow vulnerability exists in the Apache Procedural Language/Structured Query Language PL/SQL module used by Oracle9i Application Server iAS. This vulnerability could allow an unauthenticated remote attacker to cause a denial of service or execute arbitrary code on the system...

CVE-2001-0327: Undefined Security Weakness

iPlanet Web Server Enterprise Edition 4.1 and earlier allows remote attackers to retrieve sensitive data from memory allocation pools, or cause a denial of service, via a URL-encoded Host: header in the HTTP request, which reveals memory in the Location: header that is returned by the server...

Несанкционированный доступ через xitami (privelege escalation)

Пароль администратора хранится в открытом на чтение файле. Сам веб-сервер работает с привилегиями root. Администратор может изменить расположение Cgi-bin получив доступ с правами root...

RADIX1112200102

Team RADIX Research Report: RADIX1112200102 Date Published: 11-12-2001 Research Report ID: RADIX1112200102 Bugtraq ID: 3184 CVE CAN: N/A Title: RunAs Sensitive Data Exposure Class: Sensitive data exposure Remotely Exploitable: No Locally Exploitable: Yes Vulnerability Description: The command lin...

CVE-2001-0788: Undefined Security Weakness

Internet Software Solutions Air Messenger LAN Server AMLServer 3.4.2 allows remote attackers to obtain an absolute path for the server directory by viewing the Location header...

Citrix Nfuse 1.51 - Webroot Disclosure

Citrix Nfuse 1.51 - Webroot Disclosure source: https://www.securityfocus.com/bid/2956/info Citrix Nfuse is an application portal server meant to provide the functionality of any application on the server via a web browser. Nfuse works in conjunction with a previously-installed webserver. It has...

DoS в IBM NetCommerce (macro.d2w buffer overflow)

Переполнение буфера при длинном запросе к макросу macro.d2w. Кроме того, возможно узнать физическое расположение файлов...

IE5 crash

Hi stumbled across this crash for IE..I am on 5.00.2614.3500 in Win98SE it seems pretty reproducable with an illegal op in URLMON.dll 1 create a web page local is fine and put in an image to one of your servers..this crash dosent even need an image extension on it...just aim it at a directory or...

Небольшая проблема в IBM Net.Data (path retrieval)

Можно мполучить информацию о физическом расположении файлов...

Дырки в WFTPD

Большое число расширенных ASCII-символов в строке приводит к переполнению буфера. Кроме того, имеется несколько недокументированных макросов, например C позволяет выяснить физическое расположение файлов...

Microsoft Internet Explorer 5.5 - Index.dat (MS00-055)

Microsoft Internet Explorer 5.5 - Index.dat MS00-055 source: https://www.securityfocus.com/bid/1978/info IE 5.5 and possibly other versions stores recently visited URLs and cache folder names in a local file called index.dat. This file is kept in the following known locations: Windows 9x:...

CVE-2000-0854

When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.dll and msi.dll, which could allow an attacker to execute arbitrary commands by inserting a Trojan Horse DLL into the same directory as the document...

Дырки в Ceilidh

Возможно провести DoS-атаку против машины, запустив множественные экземпляры приложения, можно узнать физическое расположение файлов, кроме того имеются переполнения буфера...

CVE-2000-0280: Undefined Security Weakness

Buffer overflow in the RealNetworks RealPlayer client versions 6 and 7 allows remote attackers to cause a denial of service via a long Location URL...