CuteNews 1.3 - Debug Query Information Disclosure

source: https://www.securityfocus.com/bid/9130/info An information disclosure weakness has been reported in CuteNews 1.3, that may expose sensitive server configuration data. The problem occurs due to CuteNews accepting a debug query that will result in the exposure of information returned from a...

Half Life dedicated server information leak

Dear [email protected], Probably is known, but is not documented: Vendor: Valve software Software: hlds, all versions including steam. Problem: Information leak, DoS Author: SYZoSND Problem: in server configuration, if allowdownload = 1, it's possible to download any file from directory o...

Corsaire Security Advisory: PeopleSoft Gateway Administration servlet path disclosure issue

-- Corsaire Security Advisory -- Title: PeopleSoft Gateway Administration servlet path disclosure issue Date: 04.07.03 Application: PeopleTools 8.20/8.43 and prior Environment: Various Author: Martin O'Neal [email protected] Audience: General distribution Reference: c030704-003 -- Scope -...

mod_gzip Detection

The remote host is running modgzip and configured so that its status can be obtained by sending a special request. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11685; scriptversion"$Revision: 1.14 $"; scriptcvsdate"$Date: 2013/01/25 01:19:08 $";...

W3Mail multiple bugs

delete.cgi invokes external program though system call without escaping shell characters. It's possible to change server configuration without administrator's permissions. All passwords are stored in Base64 encoding...

Snitz Forums 3.3.03 - Remote Command Execution

!/usr/bin/perl use Socket; print "\nRemote command execution against Snitz Forums 3.3.03 and probably others.\n"; print "You accept full responsibility for your actions by using this script.\n"; print "INTERNAL USE ONLY!! DO NOT DISTRIBUTE!!\n"; print "\nWeb server? www.enterthegame.com: "; my...

Web Server Unconfigured - Default Install Page Present

The remote web server uses its default welcome page. Therefore, it's probable that this server is not used at all or is serving content that is meant to be hidden. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11422; scriptversion"1.45"; scriptcvsdate"Date: 2018/08/...

CVE-2002-1080

The Administration console for Abyss Web Server 1.0.3 before Patch 2 allows remote attackers to gain privileges and modify server configuration via direct requests to CHL files such as 1 srvstatus.chl, 2 consport.chl, 3 general.chl, 4 srvparam.chl, and 5 advanced.chl...

CVE-2002-1080

The CVE-2002-1080 entry affects Abyss Web Server 1.0.3 prior to Patch 2. Remote attackers can gain privileges and modify server configuration through direct requests to CHL files (srvstatus.chl, consport.chl, general.chl, srvparam.chl, advanced.chl). The available sources confirm the affected pro...

Apache Tomcat 3.2.33.2.4 - Source.jsp Information Disclosure

Apache Tomcat 3.2.33.2.4 - Source.jsp Information Disclosure source: https://www.securityfocus.com/bid/4876/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server...

Apache Tomcat 3.2.3/3.2.4 - 'Source.jsp' Information Disclosure

source: https://www.securityfocus.com/bid/4876/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the source.jsp page is passed a malformed...

PHP-Nuke 5.x - Error Message Web Root Disclosure

source: https://www.securityfocus.com/bid/4333/info PHP-Nuke is a popular web based Portal system. It allows users to create accounts and contribute content to the site. A vulnerability has been reported in some versions of PHP-Nuke. Reportedly, a maliciously constructed HTTP request will cause t...

PHP-Nuke 5.x - Error Message Web Root Disclosure

PHP-Nuke 5.x - Error Message Web Root Disclosure source: https://www.securityfocus.com/bid/4333/info PHP-Nuke is a popular web based Portal system. It allows users to create accounts and contribute content to the site. A vulnerability has been reported in some versions of PHP-Nuke. Reportedly, a...

Xerver-2.10-File-Disclousure&DoS-attack

------oOo------ Xerver Free Web Server 2.10 file Disclosure & DoS Denial of Service Attack. ------oOo------ Company Affected: www.JavaScript.nu Version: v2.10 Date Added: 02-27-02 Size: 287 KB OS Affected: : Windows ALL, Linux ALL, BSD all, Solaris ALL, MAC ALL. Author: Alex Hernandez...

Novell NetWare Management Portal Unrestricted Access

The NetWare Management Portal software is installed on this machine. It allows anyone to view the current server configuration and locate other Portal servers on the network. It is possible to browse the server's filesystem by requesting the volume in the URL. However, a valid user account is...

Microsoft Internet Explorer 5.5/6.0 - Spoofable File Extensions

source: https://www.securityfocus.com/bid/3597/info It is possible for a malicious webmaster, hosting files on an website, to spoof file extensions for users of Internet Explorer. For example, an .exe file can be made to look like a .txt or other seemingly harmless file type file in the Download...

Apple Mac OS X Find-By-Content .DS_Store Web Directory Listing

It is possible to read a '.DSStore' file on the remote web server. This file is created by MacOS X Finder; it is used to remember the icons position on the desktop, among other things, and contains the list of files and directories present in the remote directory. Note that deleted files may stil...

eRisk Security Advisory: PhpMyExplorer vulnerable to directory traversal.

eRisk Security Advisory August 29, 2001 ------------------------------ PhpMyExplorer, available from http://elegac.free.fr/, is vulnerable to directory traversal. Synopsis: eRiskSecurity has discovered a fatal flaw in PhpMyExplorer, a popular and very good looking PHP based file manager. It is...

CVE-2001-0033

KTH Kerberos IV allows local users to change the configuration of a Kerberos server running at an elevated privilege by specifying an alternate directory using with the KRBCONFDIR environmental variable, which allows the user to gain additional privileges...

multiple vulnerabilities in bind 8.x

Multiple vulnerabilities exist in the versions of BIND found in Slackware 7.1 and -current. Users of BIND 8.x are urged to upgrade to 8.2.3 to fix these problems. More information can be found on the BIND website: http://www.isc.org/products/BIND/ ... and in the CERT Advisory CA-2001-02 - Multipl...