CVE-2002-0499

The CVE relates to the Linux kernel vulnerability where the d_path function truncates long pathnames without error in Linux kernel versions 2.2.20 and earlier, and 2.4.18 and earlier. This behavior can cause local users to cause programs to operate on incorrect directories, potentially enabling i...

CVE-2002-0240

PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message...

CVE-2002-0215

Agora.cgi 3.2r through 4.0 while in debug mode allows remote attackers to determine the full pathname of the agora.cgi file by requesting a non-existent .html file, which leaks the pathname in an error message...

CVE-2002-0240

PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message...

CVE-2002-0341

GWWEB.EXE in GroupWise Web Access 5.5, and possibly other versions, allows remote attackers to determine the full pathname of the web server via an HTTP request with an invalid HTMLVER parameter...

CVE-2002-0215

Agora.cgi 3.2r through 4.0 while in debug mode allows remote attackers to determine the full pathname of the agora.cgi file by requesting a non-existent .html file, which leaks the pathname in an error message...

CVE-2002-0240

CVE-2002-0240 affects PHP when deployed with Apache and configured to serve index.php by default. The vulnerability allows remote attackers to learn the server’s full pathname via the HTTP OPTIONS method, leaking a partial confidentiality breach (PARTIAL) without impact to integrity/availability,...

CVE-2001-0947

Forms.exe CGI program in ValiCert Enterprise Validation Authority EVA 3.3 through 4.2.1 allows remote attackers to determine the real pathname of the server by requesting an invalid extension, which produces an error page that includes the path...

CVE-2001-0947

The CVE-2001-0947 issue affects ValiCert Enterprise Validation Authority (EVA) versions 3.3 through 4.2.1. It allows remote attackers to determine the server’s real pathname by requesting an invalid extension, which causes an error page that reveals the path. The vulnerability is a server-path di...

CVE-2001-0947

Forms.exe CGI program in ValiCert Enterprise Validation Authority EVA 3.3 through 4.2.1 allows remote attackers to determine the real pathname of the server by requesting an invalid extension, which produces an error page that includes the path...

PT-2001-2100 · Valicert · Valicert Enterprise Validation Authority

Name of the Vulnerable Software and Affected Versions: ValiCert Enterprise Validation Authority EVA versions 3.3 through 4.2.1 Description: The issue allows remote attackers to determine the real pathname of the server by requesting an invalid extension, which produces an error page that includes...

CVE-2001-0249

Heap overflow in FTP daemon in Solaris 8 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the LIST command, which uses glob to generate long strings...

CVE-2001-0248

Buffer overflow in FTP server in HPUX 11 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to generate long strings...

CVE-2001-0254

FaSTream FTP++ Server 2.0 allows remote attackers to obtain the real pathname of the server via the "pwd" command...

CVE-2001-0224

Muscat Empower CGI program allows remote attackers to obtain the absolute pathname of the server via an invalid request in the DB parameter...

CVE-2001-0452

BRS WebWeaver FTP server before 0.64 Beta allows remote attackers to obtain the real pathname of the server via a "CD " command followed by an ls command...

CVE-2001-0452

CVE-2001-0452 affects the BRS WebWeaver FTP server prior to 0.64 Beta. The vulnerability allows a remote attacker to obtain the real pathname of the server by issuing a sequence: first a problematic CD * command, followed by an ls. The available documents confirm the affected product and the exac...

CVE-2000-0876

Vulnerability summary: WFTPD and WFTPD Pro 2.41 RC12 expose the server’s full pathname to remote attackers by issuing a "%C" command, which triggers an error message revealing the path. Affected products/components: WFTPD, WFTPD Pro 2.41 RC12. Root cause/technique: error-path disclosure in server...

CVE-2001-0254

FaSTream FTP++ Server 2.0 allows remote attackers to obtain the real pathname of the server via the "pwd" command...

CVE-2001-0254

FaSTream FTP++ Server 2.0 is affected. The vulnerability allows remote attackers to reveal the server’s real pathname by issuing the pwd command, constituting an information-disclosure issue. The provided documents confirm the affected product and the nature of the data exposed (real pathname), b...