421 matches found
CVE-2007-6672
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' slash characters in the URI...
Sql injection
SQL injection vulnerability in bb-includes/formatting-functions.php in bbPress before 0.8.1 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors to forums/bb-edit.php, as demonstrated by a PRE element, aka the "quircky slashes bug."...
Directory traversal
F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via 1 a trailing null byte, 2 multiple leading slashes, 3 Unicode encoding, 4 URL-encoded directory traversal or same-directory characters, or 5 upper case letters in the domain name...
CVE-2007-0187
F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via 1 a trailing null byte, 2 multiple leading slashes, 3 Unicode encoding, 4 URL-encoded directory traversal or same-directory characters, or 5 upper case letters in the domain name...
CVE-2006-0046
squidredirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service CPU consumption via a URL with a large number of trailing / forward slashes, which might produce inefficient regular expressions...
LiteWeb Web Server protection bypass
It's possible to bypass password protection by adding additional slashes to URL...
CVE-2004-1939
Cross-site scripting XSS vulnerability in Zaep AntiSpam 2.0 allows remote attackers to inject arbitrary web script or HTML via double encoded slashes %252F in the key parameter...
CVE-2004-1939
CVE-2004-1939 affects Zaep AntiSpam 2.0. The vulnerability is a cross-site scripting (XSS) flaw in the key parameter, exploitable via double-encoded slashes (%252F). The NVD metrics show a base score of 4.3 (medium) with network attack vector, no confidentiality impact, partial integrity impact, ...
CVE-2004-1939: Undefined Security Weakness
Cross-site scripting XSS vulnerability in Zaep AntiSpam 2.0 allows remote attackers to inject arbitrary web script or HTML via double encoded slashes %252F in the key parameter...
CVE-2004-1032
fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to delete arbitrary files or create arbitrary empty files via a target filename with a large number of leading slash / characters such that fcronsighup does not properly append the intended fcrontab.sig to the...
CVE-2004-1939
Cross-site scripting XSS vulnerability in Zaep AntiSpam 2.0 allows remote attackers to inject arbitrary web script or HTML via double encoded slashes %252F in the key parameter...
Root directory access in Cisco Secure ACS
By adding additional slah to URL after hostname it's possible to address root folder...
CVE-2002-0124: Undefined Security Weakness
MDG Computer Services Web Server 4D/eCommerce 3.5.3 allows remote attackers to exploit directory traversal vulnerability via a ../ dot dot containing URL-encoded slashes in the HTTP request...
CVE-1999-1223
IIS 3.0 allows remote attackers to cause a denial of service via a request to an ASP page in which the URL contains a large number of / forward slash characters...
CVE-1999-1456: Undefined Security Weakness
thttpd HTTP server 2.03 and earlier allows remote attackers to read arbitrary files via a GET request with more than one leading / slash character in the filename...
Apache 1.3 - Artificially Long Slash Path Directory Listing (2)
Apache 1.3 - Artificially Long Slash Path Directory Listing 2 // source: https://www.securityfocus.com/bid/2503/info Apache HTTPD is the Apache Web Server, freely distributed and actively maintained by the Apache Software Foundation. It is a freely available and widely used software package,...
CVE-2001-0729
CVE-2001-0729 concerns Apache HTTP Server on Windows (Win32) where a bug in Apache 1.3.20 can expose directory contents. The vulnerability arises when a client sends a very long URI composed of many forward slashes, allowing a remote attacker to bypass the default index page and cause directory l...
Проблемы с листингом в apache
При запросе содержащем большое количество '/' можно получить листинг директории вместо index-файла...
Apache for Windows Multiple Forward Slash Directory Listing
Certain versions of Apache for Win32 have a bug wherein remote users can list directory entries. Specifically, by appending multiple /'s to the HTTP GET command, the remote Apache server will list all files and subdirectories within the web root as defined in httpd.conf. %NASLMINLEVEL 70300 This...