195 matches found
sHTTPd cross-site scripting vulnerability
Overview sHTTPd, from Uchu Ninja Neko-dan, contains a cross-site scripting vulnerability. sHTTPd from Uchu Ninja Neko-dan is a web server for Windows. sHTTPd contains a cross-site scripting vunerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the...
CVE-2007-6405
Sergey Lyubka Simple HTTPD shttpd 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended 1 '+' character, 2 '.' character, 3 %2e sequence hex-encoded dot, or 4 hex-encoded character greater than 0x7f. NOTE: the %20 vector is...
Code injection
Sergey Lyubka Simple HTTPD shttpd 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended 1 '+' character, 2 '.' character, 3 %2e sequence hex-encoded dot, or 4 hex-encoded character greater than 0x7f. NOTE: the %20 vector is...
CVE-2007-6405
CVE-2007-6405 affects Sergey Lyubka’s Simple HTTPD (shttpd) 1.38 and earlier on Windows. The issue allows remote attackers to obtain or download arbitrary CGI programs/scripts by sending a URI with special trailing characters: a plus sign (+), a dot (.), %2e (hex-encoded dot), or a hex-encoded ch...
CVE-2007-6404: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Sergey Lyubka Simple HTTPD shttpd 1.38 and earlier on Windows allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the URI...
CVE-2007-6405: Exposure of Sensitive Information to an Unauthorized Actor
Sergey Lyubka Simple HTTPD shttpd 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended 1 '+' character, 2 '.' character, 3 %2e sequence hex-encoded dot, or 4 hex-encoded character greater than 0x7f. NOTE: the %20 vector is...
Design/Logic Flaw
Sergey Lyubka Simple HTTPD shttpd 1.3 on Windows allows remote attackers to cause a denial of service via a request that includes an MS-DOS device name, as demonstrated by the /aux URI...
CVE-2007-6326
The CVE-2007-6326 entry affects Sergey Lyubka Simple HTTPD (shttpd) 1.3 on Windows. The vulnerability allows remote denial of service when a request includes an MS-DOS device name, as demonstrated by the /aux URI. The issue is triggered by processing a device-name in the request, leading to a par...
CVE-2007-6326: Improper Input Validation
Sergey Lyubka Simple HTTPD shttpd 1.3 on Windows allows remote attackers to cause a denial of service via a request that includes an MS-DOS device name, as demonstrated by the /aux URI...
Simple HTTPd 1.38 - Multiple Vulnerabilities
Luigi Auriemma Application: Simple HTTPD http://shttpd.sourceforge.net Versions: = 1.38 Platforms: Windows, nix, QNX, RTEMS only Windows seems vulnerable Bugs: A directory traversal B scripts and CGI viewing/downloading %20 char found by Shay priel in Jun 2007 Exploitation: remote Date: 07 Dec 20...
Simple HTTPd 1.38 - Multiple Vulnerabilities
Simple HTTPd 1.38 - Multiple Vulnerabilities Luigi Auriemma Application: Simple HTTPD http://shttpd.sourceforge.net Versions: = 1.38 Platforms: Windows, nix, QNX, RTEMS only Windows seems vulnerable Bugs: A directory traversal B scripts and CGI viewing/downloading %20 char found by Shay priel in...
Cross site scripting
Cross-site scripting XSS vulnerability in Kurinton sHTTPd 20070408 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2007-3541
Cross-site scripting XSS vulnerability in Kurinton sHTTPd 20070408 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2007-3541
Cross-site scripting XSS vulnerability in Kurinton sHTTPd 20070408 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2007-3541
CVE-2007-3541 concerns Kurinton sHTTPd (version 20070408 and earlier) with a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected documents corroborate this XSS issue in sHTTPd and note that an arbitrar...
CVE-2007-3541: Undefined Security Weakness
Cross-site scripting XSS vulnerability in Kurinton sHTTPd 20070408 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
SHTTPD文件名解析错误信息泄露漏洞
BUGTRAQ ID: 24618 CVECAN ID: CVE-2007-3407 SHTTPD是一款轻量级的简单易用的web服务器。 SHTTPD处理HTTP请求时存在漏洞，远程攻击者可能利用此漏洞获取脚本源码。 SHTTPD没有正确地处理HTTP请求，如果用户在所提交的URI后附加了“%20”字符的话，就可能导致泄露某些脚本的源码。 Sergey Lyubka SHTTPD 1.38 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://shttpd.sourceforge.net/...
JVN#74063879 sHTTPd cross-site scripting vulnerability
sHTTPd provided by anekos is a web server for Windows. sHTTPd contains a cross-site scripting vunerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Apply the latest updates provided by the developer. Products Affected sHTTPd version...