HTTP File Serve multiple security vulnerabilities

Crossite scripting, information disclosure, unauthroized files creation, log manipulation, user name spoofing...

security flaw

servenotify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data...

CVE-2001-0748

Acme.Serve 1.7, as used in Cisco Secure ACS Unix and possibly other products, allows remote attackers to read arbitrary files by prepending several / slash characters to the URI...

Acme.Serve 1.7 - Arbitrary File Access

source: https://www.securityfocus.com/bid/2809/info Acme.Serve is a free, open-source, embeddable webserver written in Java. It is small, is intended to provide minimal functionality, and is fully compatible with JavaServer. Acme.Serve 1.7 comes with a webserver that listens on port 9090. This...

serve-U.DoS.txt

Date: Thu, 11 Feb 1999 21:36:13 -0600 From: Ryan Sweat To: [email protected] Subject: Buffer overflow in Serve-U I have successfully reprocuded this overflow in the newest Version of Serve-U. It totally crashes the ftp program, and also causes stack fault module in tcp/ip stack rendering the...