FS-071000-5-JWS

Foundstone, Inc. http://www.foundstone.com "Securing the Dot Com World" Security Advisory Sun's Java Web Server ---------------------------------------------------------------------- FS Advisory ID: FS-071000-5-JWS Release Date: July 10, 2000 Product: Java Web Server Vendor: Sun Microsystems...

George Burgyan CGI Counter 4.0.2/4.0.7 - Input Validation

source: https://www.securityfocus.com/bid/1202/info Due to unchecked code that handles user input in George Burgyan's CGI Counter, remote execution of arbitrary commands at the same privilege level as the web server it is running on is possible. Examples:...

Matt Wright FormMail 1.61.71.8 - Environmental Variables Disclosure

Matt Wright FormMail 1.61.71.8 - Environmental Variables Disclosure source: https://www.securityfocus.com/bid/1187/info An unauthorized remote user is capable of obtaining CGI environmental variable information from a web server running Matt Wright FormMail by requesting a specially formed URL th...

[linux-security] SECURITY: UPDATED - RHSA-2000:014 New Piranha release available

--------------------------------------------------------------------- Red Hat, Inc. Security Advisory Synopsis: Piranha web GUI exposure Advisory ID: RHSA-2000:014-16 Issue date: 2000-04-18 Updated on: 2000-04-26 Product: Red Hat Linux Keywords: piranha Cross references: php -...

ISSalert: ISS Security Advisory: Backdoor Password in Red Hat Linux Virtual Server Package

TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to [email protected] Contact [email protected] for help with any problems! --------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- ISS Security Advisory April 24, 2000...

rpm_query CGI System Information Disclosure

The rpmquery CGI is installed. This CGI allows anyone who can connect to this web server to obtain the list of the installed RPMs. This allows an attacker to determine the version number of your installed services, hence making their attacks more accurate. %NASLMINLEVEL 70300 C Tenable Network...

Zeus Web Server 3.x - Null Terminated Strings

source: https://www.securityfocus.com/bid/977/info Appending "%00" to the end of a CGI script filename will permit a remote client to view full contents of the script if the CGI module option "allow CGIs anywhere" is enabled. Scripts located in directories which are designated as executable eg...

CVE-1999-0929

Novell NetWare with Novell-HTTP-Server or YAWN web servers allows remote attackers to conduct a denial of service via a large number of HTTP GET requests...

CVE-1999-0882

The Falcon web server is affected by CVE-1999-0882: remote attackers can determine the absolute path of the web root by exploiting long file names, revealing an information disclosure issue in path handling. Affected product: Falcon web server (exact versions not specified in the provided documen...

CERN httpd Virtual Web Path Disclosure

The remote host appears to be running CERN httpd. It was possible to get the physical location of a virtual web directory by issuing the request : GET /cgi-bin/ls HTTP/1.0 A remote attacker could use this information to mount further attacks. C Tenable Network Security, Inc. include"compat.inc";...

CVE-1999-1509

Directory traversal vulnerability in Etype Eserv 2.50 web server allows a remote attacker to read any file in the file system via a .. dot dot in a URL...

teamshare teamtrack 3.0 - Directory Traversal

teamshare teamtrack 3.0 - Directory Traversal source: https://www.securityfocus.com/bid/689/info TeamTrack 3.00 has a built-in webserver which is meant to be used during the evaluation period, or until IIS or Netscape Enterprise/FastTrack is installed. This server does not filter out requested...

CVE-1999-0012

Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names...

CVE-1999-0239

Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET...

NCSA 1.31.4.x1.5 Apache HTTPd 0.8.110.8.14 - ScriptAlias Source Retrieval

NCSA 1.31.4.x1.5 Apache HTTPd 0.8.110.8.14 - ScriptAlias Source Retrieval source: https://www.securityfocus.com/bid/2300/info NSCA httpd prior to and including 1.5 and Apache Web Server prior to 1.0 contain a bug in the ScriptAlias function that allows remote users to view the source of CGI...

ms.iis4.showcode.txt

L0pht Security Advisory ------------- URL Origin: http://www.l0pht.com/advisories.html Release Date: May 7th, 1999 Application: Microsoft IIS 4.0 Web Server Severity: Web users can view ASP source code and other sensitive files on the web server Author: [email protected] Operating Sys: Microsoft NT...

mac-webshare-DoS.txt

Date: Fri, 11 Dec 1998 10:47:19 +0800 From: David Luyer Reply-To: Bugtraq List To: [email protected] Subject: Apple "Web Sharing" in MacOS 8.5.1 re-sent, originally sent 9 Dec Sending... GET aaaaa...x4000...aaaaa HTTP/1.0 followed by pressing return twice to port 80 on an Apple Mac, MacOS 8.5....

IRIX webdist.cgi Arbitrary Command Execution

The 'webdist.cgi' CGI is installed. This script has a well-known security flaw that lets anyone execute arbitrary commands with the privileges of the web server user id. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

OmniHTTPd visadmin.exe Malformed URL DoS

It is possible to fill the hard disk of a server running OmniHTTPd by issuing the request : http://omni.server/cgi-bin/visadmin.exe?user=guest This allows an attacker to crash your web server. This script checks for the presence of the faulty CGI, but does not execute it. %NASLMINLEVEL 70300 C...

Gordano NTMail 4.2 - Web File Access

Gordano NTMail 4.2 - Web File Access source: https://www.securityfocus.com/bid/279/info A vulnerability in Gordano's NTMail allows remote malicious users to steal local files. Gordano's NTMail is a Windows NT mail server program. One of its features is allowing administrators to configure the...