Asus AAM6000EV ADSL Router Wide Open

Asus have been notified but haven't even acknowledged yet alone mentioned a fix. If the inbuilt webserver is activated, anyone on the local network can get the full user/pass list from the router without any identification whatsoever by going to the ip address of the router and appending /userdat...

Super-M Son hServer URI Traversal Arbitrary File Access

Super-M Son hServer is vulnerable to a directory traversal. It enables a remote attacker to view any file on the computer with the privileges of the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription scriptid11678; scriptversion"1.22";...

Zeus Web Server 4.x - Admin Interface VS_Diag.cgi Cross-Site Scripting

Zeus Web Server 4.x - Admin Interface VSDiag.cgi Cross-Site Scripting source: https://www.securityfocus.com/bid/7751/info The Zeus Web Server contains a web based administration interface that is vulnerable to cross site scripting attacks. Due to insufficient sanitization of user-supplied input, ...

Webfroot Shoutbox 2.32 - 'URI' File Disclosure

source: https://www.securityfocus.com/bid/7737/info Shoutbox is prone to directory traversal attacks. The vulnerability exists due to insufficient sanitization of user-supplied values to URI parameters. An attacker can exploit this vulnerability by manipulating the value of the affected 'conf' UR...

12Planet Chat Server Error Message Path Disclosure

The remote host is running 12Planet Chat Server - a web-based chat server written in Java. There is a flaw in this version which allows an attacker to obtain the physical path of the installation by sending a malformed request to this service. Knowing this information will help an attacker to mak...

MDG Web Server 4D GET Request Remote Overflow

It is possible to kill the web server by sending an oversized string of '' as an argument to a GET request. An attacker may exploit this vulnerability to make your web server crash continually or even execute arbitrary code on your system. C Tenable Network Security, Inc. include 'compat.inc' ;...

[NT] Twilight Utilities Denial of Service Vulnerability (TW-WebServer)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion In the US? Contact Beyond Security at our new California office housewarming rates on automated network vulnerability scanning. We also...

Coppermine Photo Gallery 1.0 - PHP Code Injection

source: https://www.securityfocus.com/bid/7300/info Coppermine Photo Gallery has been reported prone to PHP code injection attacks. Due to a lack of sufficient sanitization performed on user-supplied filenames that are uploaded into the Photo Gallery, an attacker may upload a malicious JPEG. The...

CVE-2002-0897

LocalWEB2000 2.1.0 web server allows remote attackers to bypass access restrictions for restricted files via a URL that contains the "/./" directory...

Siteframe search.php searchfor Parameter XSS

Siteframe 2.2.4 has a cross-site scripting bug. An attacker may use it to perform a cross-site scripting attack on this host. In addition to this, another flaw in this package may allow an attacker to obtain the physical path to the remote web root. %NASLMINLEVEL 70300 written by K-Otik.com...

GTcatalog index.php custom Parameter Remote File Inclusion

It is possible to make the remote host include PHP files hosted on a third-party server using GTcatalog. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the privileges of the web server. In addition, making a direct request for 'password.inc' may...

CuteNews 0.88 - shownews.php Remote File Inclusion

CuteNews 0.88 - shownews.php Remote File Inclusion source: https://www.securityfocus.com/bid/6935/info CuteNews is prone to an issue that may allow remote attackers to include files located on remote servers. Under some circumstances, it is possible for remote attackers to influence the include...

Apache Web Server 2.0.x - MS-DOS Device Name Denial of Service

Apache Web Server 2.0.x - MS-DOS Device Name Denial of Service source: https://www.securityfocus.com/bid/6662/info A vulnerability has been reported in Apache Web server for Microsoft Windows. The vulnerability exists in the way some HTTP requests are handled by the Apache Web server. Specificall...

Trend Micro Virus Control System 1.8 - Denial of Service

source: https://www.securityfocus.com/bid/6617/info A denial of service vulnerability has been reported for Trend Micro TVCS. The vulnerability occurs when numerous requests for 'activesupport.exe' are made. This will cause the web server to stop responding to requests for a limited period of tim...

Trend Micro Virus Control System 1.8 - Denial of Service

Trend Micro Virus Control System 1.8 - Denial of Service source: https://www.securityfocus.com/bid/6617/info A denial of service vulnerability has been reported for Trend Micro TVCS. The vulnerability occurs when numerous requests for 'activesupport.exe' are made. This will cause the web server t...

CVE-2002-2114

Artekopia Netjuke before 1.0 b7 allows remote attackers to execute arbitrary code on the web server, possibly via the section parameter, which is passed to an eval call...

CVE-2002-1785

Cross-site scripting XSS vulnerability in Zeus Administration Server in Zeus Web Server 4.0 through 4.1r2 allows remote authenticated users to inject arbitrary web script or HTML via the section parameter to index.fcgi...

CVE-2002-2014

Lotus Domino 5.0.8 web server returns different error messages when a valid or invalid user is provided in HTTP requests, which allows remote attackers to determine valid user names and makes it easier to conduct brute force attacks...

Web server vulnerability in Axis Network Cameras, Video Servers and DVRs

Date: 20 December 2002 1. Topic Web server vulnerability in Axis Network Cameras, Video Servers and Network Digital Video Recorders. 2. Description A potential stack buffer overflow has been found in the authentication code of the modified version of Boa used in some of the embedded Linux based...

KW Whois CGI whois Parameter Arbitrary Command Execution

The version of the KW whois CGI script installed on the remote web server fails to filter input to the 'whois' parameter of shell metacharacters. An unauthenticated, remote attacker can leverage this issue to execute arbitrary commands with the privileges of the http daemon. %NASLMINLEVEL 70300 C...