QuickTicket multiple sql inj.

QuickTicket multiple sql inj. Vuln. discovered by : r0t Date: 27 June 2007 vendor:http://www.qt-cute.org/ orginal advisory: http://pridels-team.blogspot.com/2007/06/quickticket-multiple-sql-inj.html affected versions: tested on QuickTicket 1.2 build:20070621 other versions also can be affected...

CVE-2007-3407

Sergey Lyubka Simple HTTPD shttpd 1.38 allows remote attackers to obtain sensitive information script source code via a URL with a trailing encoded space %20...

Code injection

Sergey Lyubka Simple HTTPD shttpd 1.38 allows remote attackers to obtain sensitive information script source code via a URL with a trailing encoded space %20...

SHTTPD HTTP server information leak

It's possible to access scripts source code with request of kind http://127.0.0.1/test.php20...

CVE-2007-3407: Undefined Security Weakness

Sergey Lyubka Simple HTTPD shttpd 1.38 allows remote attackers to obtain sensitive information script source code via a URL with a trailing encoded space %20...

myserver-disclose.txt

The vulnerability is caused due to a parser error of the filename extension supplied by the user in the URL. This can be exploited to retrieve the source code of script files. Found By:Shay Priel aka Prili site: http://www.myserverproject.net/ poc: ---- http://localhost/cgi-bin/post.mscgI I -...

SHTTPD V1.38 server source code disclosure

SHTTPD V1.38 server source code disclosure ------------------------------------ link:http://shttpd.sourceforge.net/ info: The vulnerability is caused due to a parser error of the filename extension supplied by the user in the URL. This can be exploited to retrieve the source code of script files...

Design/Logic Flaw

MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive information script source code via a modified extension, as demonstrated by post.mscgI...

CVE-2007-3365

MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive information script source code via a modified extension, as demonstrated by post.mscgI...

ClickGallery Server vuln.

ClickGallery Server vuln. Vuln. discovered by : r0t Date: 2 May 2007 vendor:http://www.clicktech.com/ orginal advisory: http://pridels-team.blogspot.com/2007/06/clickgallery-server-vuln.html affected versions: 5.1 and previous 1. ClickGallery Server contains a flaw that allows a remote sql...

CVE-2007-3365: Improper Handling of Case Sensitivity

MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive information script source code via a modified extension, as demonstrated by post.mscgI...

access2asp XSS vuln.

access2asp XSS vuln. Vuln. discovered by : r0t Date: 22 June 2007 vendor:http://www.access2asp.com/ orginal advisory: http://pridels-team.blogspot.com/2007/06/access2asp-xss-vuln.html affected versions: access2asp v4.5 and prior access2asp contains a flaw that allows a remote Cross-Site Scripting...

Code injection

httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information script source code via a URI with a trailing %20 encoded space...

CVE-2007-3327

httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information script source code via a URI with a trailing %20 encoded space...

CVE-2007-3327: Undefined Security Weakness

httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information script source code via a URI with a trailing %20 encoded space...

HTTP SERVER (httpsv1.6.2) source code disclosure

HTTP SERVER httpsv1.6.2 source code disclosure http://httpsv.sourceforge.net/ The vulnerability is caused due to a parser error of the filename extension supplied by the user in the URL. This can be exploited to retrieve the source code of script files. POC: http://127.0.0.1/test.htm20 Bug Found...

MyServer-0.8.9 - source code disclosure

The vulnerability is caused due to a parser error of the filename extension supplied by the user in the URL. This can be exploited to retrieve the source code of script files. Found By:Shay Priel aka Prili site: http://www.myserverproject.net/ poc: ---- http://localhost/cgi-bin/post.mscgI I -...

Interact multiple XSS vuln.

Interact multiple XSS vuln. Vuln. discovered by : r0t Date: 21 June 2007 vendor:www.interactole.org orginal advisory: http://pridels-team.blogspot.com/2007/06/interact-multiple-xss-vuln.html affected versions: tested on "Interact 2.4 beta 1" other versions also can be affected. Interact contains ...

MyServer HTTP server multiple security vulnerabilities

Crossite scripting with demo pages, script source code access with capital character in path...

PHPAccounts vuln.

PHPAccounts vuln. Vuln. discovered by : r0t Date: 21 June 2007 vendor:http://phpaccounts.com/ orginal advisory: http://pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html affected versions: PHPAccounts 0.5 other versions also can be affected. 1.Local file inclussion PHPAccounts contains a fla...