2468 matches found
Apache allows arbitrary code execution via crafted POST request containing MS-DOS device name
Overview Due to a flaw in the Apache web server's handling of MS-DOS device names, an attacker may be able to remotely execute code on systems running the Apache web server under some versions of Microsoft Windows. Description The Apache HTTP server fails to filter POST requests for MS-DOS style...
CVE-2003-0045
Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service thread hang and resource consumption via a request for a JSP page containing an MS-DOS device name, such as aux.jsp...
Apache Web Server 2.0.x - MS-DOS Device Name Denial of Service
Apache Web Server 2.0.x - MS-DOS Device Name Denial of Service source: https://www.securityfocus.com/bid/6662/info A vulnerability has been reported in Apache Web server for Microsoft Windows. The vulnerability exists in the way some HTTP requests are handled by the Apache Web server. Specificall...
Apache Web Server 2.0.x - MS-DOS Device Name Denial of Service
source: https://www.securityfocus.com/bid/6662/info A vulnerability has been reported in Apache Web server for Microsoft Windows. The vulnerability exists in the way some HTTP requests are handled by the Apache Web server. Specifically, HTTP GET requests that involve reserved MS-DOS device names...
CVE-2002-1780
BPM Studio Pro 4.2 by ALCATech GmbH includes a webserver that allows a remote attacker to cause a denial of service crash by sending a URL request for a MS-DOS device such as con. NOTE: it has been disputed that this and possibly other application-level DOS device issues stem from a bug in Window...
CVE-2002-2421
acWEB 1.14 allows remote attackers to cause a denial of service crash via an HTTP request for a MS-DOS device name such as COM2...
CVE-2002-1916
Pirch and RusPirch, when auto-log is enabled, allows remote attackers to cause a denial of service crash via a nickname containing an MS-DOS device name such as AUX, which is inserted into a filename for saving queries...
CVE-2002-2090
Caucho Technology Resin server 2.1.1 to 2.1.2 allows remote attackers to obtain server's root path via requests for MS-DOS device names such as lpt9.xtp...
Microsoft Windows SQL Server allows arbitrary queries to be executed via "xp_execresultset" extended procedure
Overview MS SQL Server contains an extended stored procedure with inappropriate permission settings. Description Microsoft SQL Server 7.0 and Microsoft SQL Server 2000 contain an extended stored procedure, xpexecresultset , that permits an unprivileged user of a database to gain administrative...
CVE-2002-0645
Technical details for CVE-2002-0645 are not publicly provided in the connected documents; the available sources reference the vulnerability at a high level. Monitor for updates from official advisories.
CVE-2001-0726
CVE-2001-0726 concerns Outlook Web Access (OWA) in Microsoft Exchange 5.5 Server. The issue arises when OWA is used with Internet Explorer and fails to properly detect certain inline script in HTML emails, which can allow remote attackers to perform arbitrary actions on a user’s Exchange mailbox....
Microsoft SQL Server 2000 Microsoft Jet 4.0 Engine - Unicode Buffer Overflow (PoC)
Microsoft SQL Server 2000 Microsoft Jet 4.0 Engine - Unicode Buffer Overflow PoC source: https://www.securityfocus.com/bid/5057/info Microsoft SQL Server is prone to a remotely exploitable unicode-based buffer overflow condition. This condition occurs when the OpenDataSource function is used with...
CVE-2002-0200
Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name...
CVE-2001-1243
CVE-2001-1243 affects Microsoft IIS 4.0/5.0 with asp.dll Scripting.FileSystemObject. The vulnerability allows local or remote attackers to cause a denial of service (crash) by: (1) crafting an ASP program using Scripting.FileSystemObject to open a file using an MS-DOS device name, or (2) injectin...
CVE-2001-1249
vWebServer 1.2.0 allows remote attackers to cause a denial of service via a URL that contains MS-DOS device names...
CVE-2002-0154
Microsoft SQL Server 7.0 and SQL Server 2000 contain buffer overflow vulnerabilities in multiple extended stored procedures. A remote attacker could exploit these to cause a denial of service or execute arbitrary code (potentially with the SQL Server service account privileges), and could even af...
CVE-2002-0106
BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name...
CVE-2001-0696
NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service crash via a CD command to a directory with an MS-DOS device name such as con...
CVE-2001-0558
CVE-2001-0558 affects Jana Webserver 2.01 beta 1 and earlier. A remote attacker can cause a denial of service by sending a URL request that includes an MS-DOS device name (e.g., GET /aux HTTP/1.0). Connected sources corroborate the DOS impact via MS-DOS device names; OpenVAS/Nessus references lis...