Code injection

download.php in McGallery 0.5b allows remote attackers to read arbitrary files and obtain script source code via the filename parameter...

CVE-2007-1478

download.php in McGallery 0.5b allows remote attackers to read arbitrary files and obtain script source code via the filename parameter...

webspell-exec.txt

!/usr/bin/php URL: http://www.acid-root.new.fr/ ----------------------------------------------------------------------- Usage: $argv0 -url -file Options Params: -url For example http://victim.com/webspell/ -file The file you wanna upload c99shell.php... Options: -prefix Table prefix default=webs...

yald10-xss.txt

Yet Another Link Directory v1.0 http://yald.sourceforge.net/ Effected files: yald.php --------------------------- yald.php search box XSS User input isn't sanatized before being generated. In the search box for a PoC put: url:...

SoftArtisans FileUp(TM) viewsrc.asp remote script source disclosure exploit

Inge Henriksen Security Advisory - Full Disclosure Proof of Concept at http://ingehenriksen.blogspot.com/ Advisory Name: SoftArtisans FileUpTM viewsrc.asp remote script source disclosure exploit Tested and Confirmed Vulerable: SoftArtisans SAFileUpTM 5.0.14 Standard Severity: High Type: Script...

SoftArtisans SAFileUp 5.0.14 - 'viewsrc.asp' Script Source Disclosure

SoftArtisans FileUp viewsrc.asp remote script source disclosure exploit Advisory Name: SoftArtisans FileUpTM viewsrc.asp remote script source disclosure exploit Tested and Confirmed Vulerable: SoftArtisans SAFileUpTM 5.0.14 Standard Severity: High Type: Script source disclosure From where: Remote...

Mono XSP for ASP.NET Server Crafted Request Script Source Code Disclosure

The remote host is running Mono XSP, a lightweight web server for hosting ASP.NET applications. The version of Mono XSP installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue to disclose the source of scrip...

Apache 2.2.2 - CGI Script Source Code Information Disclosure

Apache 2.2.2 - CGI Script Source Code Information Disclosure source: https://www.securityfocus.com/bid/19447/info Apache is prone to an information-disclosure vulnerability because it fails to properly handle exceptional conditions. An attacker can exploit this issue to retrieve script source cod...

Code injection

jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations...

CVE-2006-2759

jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations...

CVE-2006-2759

Jetty 6.0.x (jetty6) beta16 has an information-disclosure vulnerability: remote attackers can read the source of JSP files by using a capital P in the .jsp extension (and likely other mixed-case variants). The issue is confirmed across multiple sources (NVD, SUSE, GHSA, OSV, Veracode, PRION, CVE ...

Ipswitch WhatsUp Professional 2006 - NmConsoleToolResults.asp?sHostname Cross-Site Scripting

Ipswitch WhatsUp Professional 2006 - NmConsoleToolResults.asp?sHostname Cross-Site Scripting source: https://www.securityfocus.com/bid/17964/info WhatsUp Professional is prone to multiple input-validation vulnerabilities. The issues include remote file-include, information-disclosure, source-code...

Ipswitch WhatsUp Professional 2006 - NmConsoleNavigation.asp?sDeviceView Cross-Site Scripting

Ipswitch WhatsUp Professional 2006 - NmConsoleNavigation.asp?sDeviceView Cross-Site Scripting source: https://www.securityfocus.com/bid/17964/info WhatsUp Professional is prone to multiple input-validation vulnerabilities. The issues include remote file-include, information-disclosure, source-cod...

[SA19325] Xeneo Web Server Script Source Disclosure Vulnerability

TITLE: Xeneo Web Server Script Source Disclosure Vulnerability SECUNIA ADVISORY ID: SA19325 VERIFY ADVISORY: http://secunia.com/advisories/19325/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Xeneo Web Server 2.x http://secunia.com/product/69...

RaidenHTTPD Web server / Quick 'n Easy Web Server / Baby ASP / Blazix Web Server / AN HTTPD / Xeneo scripts source code disclosure

It's possible to retrieve script source code by adding " ./" to request...

Privilege escalation

NetworkActiv Web Server 3.5.15 allows remote attackers to read script source code via a crafted URL with a "/" forward slash after the file extension...

CVE-2006-0815

NetworkActiv Web Server 3.5.15 allows remote attackers to read script source code via a crafted URL with a "/" forward slash after the file extension...

CVE-2006-0815

NetworkActiv Web Server 3.5.15 allows remote attackers to read script source code via a crafted URL with a "/" forward slash after the file extension...

RaidenHTTPD Crafted Request Script Source Disclosure

The remote host is running RaidenHTTPD, a web server for Windows. According to its banner, the version of RaidenHTTPD installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue to disclose the source of scripts...

[SA19032] RaidenHTTPD Script Source Disclosure Vulnerability

TITLE: RaidenHTTPD Script Source Disclosure Vulnerability SECUNIA ADVISORY ID: SA19032 VERIFY ADVISORY: http://secunia.com/advisories/19032/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: RaidenHTTPD 1.x http://secunia.com/product/4614/...