Microsoft ASP.NET Malformed File Request Path Disclosure

ASP.NET is vulnerable to a path disclosure attack. This allows an attacker to determine where the remote web root is physically stored in the remote file system, hence gaining more information about the remote system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Re: Mrtg Path Disclosure Vulnerability

/mrtg.cgi?log=scriptalert'CSS'/script /mrtg.cgi?log=scriptalert'Cross Site Scripting'/script /mrtg.cgi?cfg=../../etc/passwd : ------------------- mrtg.cgi error ------------------------ Software error: ERROR: CFG Error Unknown Option "root:PASS:0:0:root:/root" on line 2 or above. Check...

Mrtg Path Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mrtg Path Disclosure Vulnerability Type: Input Validation Error Release Date: February 4, 2002 Product / Vendor: The Multi Router Traffic Grapher Mrtg is a tool to monitor the traffic load on network-links. Mrtg generates html pages containing gif...

CVE-2001-1023

Xcache 2.1 allows remote attackers to determine the absolute path of web server documents by requesting a URL that is not cached by Xcache, which returns the full pathname in the Content-PageName header...

CVE-2001-0934

Cooolsoft PowerFTP Server 2.03 is vulnerable: the pwd command discloses the full server root path, enabling information disclosure. Impact is partial confidentiality; no exploitation details are provided. No remediation is stated in the supplied documents.

Agora.CGI 3/4 - Debug Mode Full Path Disclosure

source: https://www.securityfocus.com/bid/3976/info Agora.cgi is a freely available, open source shopping cart system. When debug mode is enabled, it is possible for a remote attacker to display the absolute path to the directory that the agora.cgi script is stored in. This is possible by making ...

Agora.CGI 34 - Debug Mode Full Path Disclosure

Agora.CGI 34 - Debug Mode Full Path Disclosure source: https://www.securityfocus.com/bid/3976/info Agora.cgi is a freely available, open source shopping cart system. When debug mode is enabled, it is possible for a remote attacker to display the absolute path to the directory that the agora.cgi...

CVE-2001-1437

easyScripts easyNews 1.5 allows remote attackers to obtain the full path of the web root via a view request with a non-integer news message id field, which leaks the path in a PHP error message when the script times out...

Apache Tomcat Nonexistent File Error Message Path Disclosure

Tomcat will reveal the physical path of the webroot when asked for a nonexistent .jsp file. An unauthenticated, remote attacker can exploit this via a specially crafted request. An attacker can use this flaw to gain further knowledge about the remote filesystem layout. %NASLMINLEVEL 70300 C Tenab...

IRM Security Advisory: Xcache Path Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- IRM Security Advisory No. 001 Xcache Webserver Cache Path Disclosure Vulnerability Vulnerablity Type / Importance: Information Leakage / Medium Problem discovered: Mon, 17 Sep 2001...

CVE-2001-1023

Xcache 2.1 allows remote attackers to determine the absolute path of web server documents by requesting a URL that is not cached by Xcache, which returns the full pathname in the Content-PageName header...

Microsoft Index Server 2.0 - File Information Full Path Disclosure

Microsoft Index Server 2.0 - File Information Full Path Disclosure source: https://www.securityfocus.com/bid/3339/info The sqlqhit.asp sample file is used for performing web-based SQL queries. Malicious users could send specifically crafted HTTP request to an Internet Information Services server...

Microsoft Index Server 2.0 - File Information / Full Path Disclosure

source: https://www.securityfocus.com/bid/3339/info The sqlqhit.asp sample file is used for performing web-based SQL queries. Malicious users could send specifically crafted HTTP request to an Internet Information Services server running Index Server to reveal path information, file attributes, a...

CVE-2000-1191

htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file using the config parameter, which generates an error message that includes the full path...

CVE-2001-0704

The CVE-2001-0704 entry affects Arcadia Internet Store 1.0 (tradecli.dll); a remote attacker can disclose the full path to the working directory by requesting a URL that uses a template argument for a file that does not exist. Documented impact aligns with partial confidentiality/integrity/availa...

CVE-2001-0452

BRS WebWeaver FTP server before 0.64 Beta allows remote attackers to obtain the real pathname of the server via a "CD " command followed by an ls command...

1C: Arcadia Internet Store 1.0 - Path Disclosure

source: https://www.securityfocus.com/bid/2904/info 1C: Arcadia Internet Store is a online shopping utility for Microsoft Windows NT/2000 that is fully integratable with 1C: Enterprise, another popular Russian web-commerce utility. One of the components of this package, 'tradecli.dll', allows use...

1C: Arcadia Internet Store 1.0 - Path Disclosure

1C: Arcadia Internet Store 1.0 - Path Disclosure source: https://www.securityfocus.com/bid/2904/info 1C: Arcadia Internet Store is a online shopping utility for Microsoft Windows NT/2000 that is fully integratable with 1C: Enterprise, another popular Russian web-commerce utility. One of the...

Multiple Vulnerabilities In AMLServer

Strumpf Noir Society Advisories ! Public release ! -- -= Multiple Vulnerabilities In AMLServer =- Release date: Monday, June 18, 2001 Introduction: Air Messenger LAN Server is a paging gateway server for MS Windows that allows you to send and recieve messages to a paging network over a TCP/IP LAN...

Internet Software Solutions Air Messenger LAN Server 3.4.2 - Full Path Disclosure

Internet Software Solutions Air Messenger LAN Server 3.4.2 - Full Path Disclosure source: https://www.securityfocus.com/bid/2881/info Air Messenger LAN Server for Microsoft Windows allows users to exchange phone, pager and email messages through a Web gateway. The path to sensitive files used by...