846 matches found
CVE-2001-0614
CVE-2001-0614 affects Carello E-Commerce. Connected sources confirm a remote command-execution vulnerability in Carello.dll up to version 1.3, exploitable via a specially crafted URL, allowing arbitrary commands with the web server’s privileges. Impact is described as remote code execution with w...
CVE-2001-1026
Trend Micro InterScan AppletTrap 2.0 does not properly filter URLs when they are modified in certain ways such as 1 using a double slash // instead of a single slash, 2 URL-encoded characters, 3 requesting the IP address instead of the domain name, or 4 using a leading 0 in an octet of an IP...
CVE-2001-0439
licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...
WebTrends Enterprise Reporting Server 3.1 c3.5 - Source Code Disclosure
WebTrends Enterprise Reporting Server 3.1 c3.5 - Source Code Disclosure source: https://www.securityfocus.com/bid/2812/info WebTrends Live is a web-based reporting service which provides interactive tracking of usage statistics and E-commerce revenue. It is possible to view the source code of...
CVE-1999-0758
Netscape Enterprise 3.5.1 and FastTrack 3.01 servers allow a remote attacker to view source code to scripts by appending a %20 to the script's URL...
Дырка в Internet Explorer (local variable exposure)
При использовании URL типа http://www.evil.org/VAR можно получить значение переменной VAR...
Ultimate Bulletin Board Version 5.47e
About: "Ultimate Bulletin Board Version 5.47e" by "www.infopop.com" on Cross-Platform tested on UNIX Subject: Another possibility to read in private forums Status: Vendors took aknoledgement; No reply of any solution yet; Details: As still known, there've been some security problem in UBB up to...
CVE-2000-0850
Netegrity SiteMinder before 4.11 allows remote attackers to bypass its authentication mechanism by appending "$/FILENAME.ext" where ext is .ccc, .class, or .jpg to the requested URL...
CVE-2000-1050
The CVE-2000-1050 entry concerns Allaire JRun 3.0/3.1-era HTTP servlet servers where an information-disclosure vulnerability allows remote attackers to access WEB-INF (and related) directories. The root cause is an information-disclosure path handling flaw triggered by a URL request that contains...
CVE-2000-1238
BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / forward slash characters before the restricted pages...
CVE-2000-0884
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability...
Inktomi Search Software 3.0 - Source Disclosure
source: https://www.securityfocus.com/bid/2061/info A vulnerability exists in version 3.0 of Ultrseek server aka Inktomi Search. Due to a failure to properly validate user-supplied input, URLs submitted by a remote user of the form: http://target:8765/somefile.html/ will return the source to...
RESIN ServletExec JSP Source Disclosure Vulnerability(IIS 5)
Resintm serves the fastest servlets and JSP. With Java and JavaScript support, Resin gives web applications the flexibility to choose the right language for the task. Resin's leading XSL XML stylesheet language support encourages separation of content from formatting. Resin provides a fast servle...
CVE-2000-0850
Netegrity SiteMinder before 4.11 allows remote attackers to bypass its authentication mechanism by appending "$/FILENAME.ext" where ext is .ccc, .class, or .jpg to the requested URL...
CVE-2000-0683
BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /.shtml/ into the URL, which invokes the SSIServlet...
CVE-2000-0682
BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServlet...
thatware.txt
Summary The security vulnerabilities in Thatware allows attacker to gain administrative access to the application. Thatware is a news portal administration, open source, and freely downloaded at: http://www.atthat.com/ Vulnerable systems Thatware 0.3 Exploit 1: If we send it...
CVE-2000-0499
The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case...