iPlanet Web Server < 4.1 SP7 URL-Encoded Host: Information Disclosure

Binary data 2181.prm...

CVE-2002-1567: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script...

CVE-2003-0475

Directory traversal vulnerability in iWeb Server 2 allows remote attackers to read arbitrary files via an HTTP request containing URL-encoded .. sequences "%5c%2e%2e", a different vulnerability than CVE-2003-0474...

CVE-2003-0475: Undefined Security Weakness

Directory traversal vulnerability in iWeb Server 2 allows remote attackers to read arbitrary files via an HTTP request containing URL-encoded .. sequences "%5c%2e%2e", a different vulnerability than CVE-2003-0474...

CVE-2003-0317: Undefined Security Weakness

iisPROTECT 2.1 and 2.2 allows remote attackers to bypass authentication via an HTTP request containing URL-encoded characters...

CVE-2002-0809

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the...

CVE-2002-0809

Bugzilla 2.14 before 2.14.2 and 2.16 before 2.16rc2 mishandles URL-encoded field names generated by some browsers, causing certain fields to appear unset and resulting in removal of group permissions on bugs when buglist.cgi is used with the encoded field names. Affected components: Bugzilla bug ...

CVE-2002-0543: Undefined Security Weakness

Directory traversal vulnerability in Aprelium Abyss Web Server abyssws before 1.0.0.2 allows remote attackers to read files outside the web root, including the abyss.conf file, via URL-encoded .. dot dot sequences in the HTTP request...

CVE-2002-0809: Undefined Security Weakness

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the...

CVE-2003-0106: Undefined Security Weakness

The HTTP proxy for Symantec Enterprise Firewall SEF 7.0 allows proxy users to bypass pattern matching for blocked URLs via requests that are URL-encoded with escapes, Unicode, or UTF-8...

CVE-2002-1422: Undefined Security Weakness

admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters...

CVE-2002-1213: Undefined Security Weakness

Directory traversal vulnerability in RadioBird Software WebServer 4 Everyone 1.23 and 1.27, and other versions before 1.30, allows remote attackers to read arbitrary files via an HTTP request with ".." dot-dot sequences containing URL-encoded forward slash "%2F" characters...

CVE-2002-1133

Encoded directory traversal vulnerability in Dino's web server 2.1 allows remote attackers to read arbitrary files via ".." dot dot sequences with URL-encoded 1 "/" %2f" or 2 "" %5c characters...

CVE-2002-1133: Undefined Security Weakness

Encoded directory traversal vulnerability in Dino's web server 2.1 allows remote attackers to read arbitrary files via ".." dot dot sequences with URL-encoded 1 "/" %2f" or 2 "" %5c characters...

CVE-2002-0893

The CVE-2002-0893 entry maps to ServletExec 4.1 ISAPI vulnerability in the JSP10Servlet that enables directory traversal. Multiple connected sources describe that by issuing a URL-encoded "..%5c" (modified dot-dot) to com.newatlanta.servletexec.JSP10Servlet, an attacker can read arbitrary files w...

CVE-2002-0922

The CVE-2002-0922 issue affects the CGIScript.net csNews.cgi CGI script. It allows remote attackers to obtain database files (default.db and default.db.style) via direct URL-encoded requests, and also permits remote authenticated users to perform administrative actions when a database parameter i...

CVE-2002-0922: Undefined Security Weakness

CGIScript.net csNews.cgi allows remote attackers to obtain database files via a direct URL-encoded request to 1 default%2edb or 2 default%2edb.style, or remote authenticated users to perform administrative actions via 3 a database parameter set to default%2edb...

Abyss Web Server 1.0 - Encoded Backslash Directory Traversal

source: https://www.securityfocus.com/bid/5547/info A directory traversal vulnerability has been reported for Abyss Web Server. The issue is related to the failure to properly process the backslash '', encoded as '%5c', character, which may be used as a directory delimiter under these platforms...

GoAhead Web Server 2.1.x - URL Encoded Slash Directory Traversal

GoAhead Web Server 2.1.x - URL Encoded Slash Directory Traversal source: https://www.securityfocus.com/bid/5197/info A vulnerability has been reported for GoAhead WebServer 2.1. Reportedly, it is possible to launch directory traversal attacks against GoAhead WebServer. It is possible for remote...

CVE-2001-1248

CVE-2001-1248 affects vWebServer 1.2.0, enabling remote attackers to view arbitrary ASP scripts by requesting an ASP file that ends with a URL-encoded space (%20). The issue is classified as a information-disclosure vulnerability (CVSSv2 base score 5.0, AV:N/AC:L/Au:N/C:P/I:N/A:N); no exploit spe...