iXsecurity.20020404.4d_webserver.a

iXsecurity Security Vulnerability Report No: iXsecurity.20020404.4dwebserver.a ================================== Vulnerability Summary --------------------- Problem: The 4D webserver has a buffer overflow condition. Threat: An attacker could make the webserver crash and possibly execute arbitrar...

[NT] Sambar Webserver Serverside Fileparse Bypass

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion When was the last time you checked your server's security? How about a monthly report? http://www.AutomatedScanning.com - Know that you're...

iXsecurity.20020314.csadmin_fmt.a

iXsecurity Security Vulnerability Report No: iXsecurity.20020314.csadminfmt.a ======================================== Vulnerability Summary --------------------- Problem: Cisco Secure ACS webserver has a format string vulnerability. Threat: An attacker could send an "invalid" URL to the webserve...

Savant Webserver Buffer Overflow Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Savant Webserver Buffer Overflow Vulnerability Type: DoS, crashes Daemon Release Date: January 5, 2002 Product / Vendor: Savant is a freeware open source web server that runs on Windows 95, 98, ME, NT, and 2000, turning any desktop computer into a...

Xitami Webserver stores admin password in clear text.

I am releasing this a bit early as the vendor has been aware of this issue for a while now. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vapid Labs Larry W. Cashdollar Xitami Webserver clear text password storage vulnerability. Date Published: 11/23/2001 Advisory ID: 11232001-02 Title: Xitami...

New Roxen Webserver Library Issues

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++GOBBLES+SECURITY+RESEARCH+TEAM+INCORPORATED+++++++++++++++++ ALERT! ALERT! A NEW BUFFER OVERFLOW IN LIBRARY FROM ROXEN! ALERT! ALERT! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++...

Advisory for MP3Mystic

Advisory for MP3Mystic MP3Mystic is made by mp3mystic.com Site: http://www.mp3mystic.com by nemesystm of the DHC http://dhcorp.cjb.net - [email protected] ADV-0117 /-|=explanation=|- MP3Mystic is a webserver that lets a visitor browse your harddrive only showing MP3 files. It is vulnerable to...

Advisory for Xitami 2.4d7, 2.5d4

Advisory for Xitami 2.4d7, 2.5d4 Xitami is made by Imatix. Site: http://xitami.com by nemesystm of the DHC http://dhcorp.cjb.net - [email protected] ADV-0105 /-|=explanation=|- Xitami is a webserver. It has a denial of service. /-|=who is vulnerable=|- Anyone running Xitami 2.5d4, 2.4d7 and...

Vulnerability in Resin Webserver

----- Begin Hush Signed Message from [email protected] ----- Vulnerability in Resin Webserver Overview Resin 1.2.2 is a webserver available from http://www.caucho.com and http://java.tucows.com. A vulnerability exists which allows a remote user to break out of the web root using relative path...

Bajie WebServer 0.78/0.90 - Remote Command Execution

source: https://www.securityfocus.com/bid/2388/info It is possible to execute arbitrary commands on a host running Bajie Webserver. A remote user can use Bajie's built-in upload feature to place malicious scripts on Bajie webservers. These uploaded scripts are placed in known destination...

Bajie 0.78 - Arbitrary Shell Command Execution

Bajie 0.78 - Arbitrary Shell Command Execution source: https://www.securityfocus.com/bid/2389/info Requesting a specailly crafted URL containg arbitrary code, can be exected on a Unix system running Bajie Webserver. Any arbitrary commands appended to a malicious URL after the ';' will be executed...

Cisco Catalyst 3500 XL - Arbitrary Command Execution

Cisco Catalyst 3500 XL - Arbitrary Command Execution source: https://www.securityfocus.com/bid/1846/info A vulnerability exists in the webserver configuration interface which will allow an anonymous user to execute commands. A http request which includes /exec and a known filename will reveal the...

Cisco Catalyst 3500 XL - Arbitrary Command Execution

source: https://www.securityfocus.com/bid/1846/info A vulnerability exists in the webserver configuration interface which will allow an anonymous user to execute commands. A http request which includes /exec and a known filename will reveal the contents of the particular file. In addition to...

CVE-2000-0842

CVE-2000-0842 affects the UnixWare 7 scohelphttp webserver. The vulnerability is in the search97cgi/vtopic component, where a path traversal via a .. (dot dot) attack could allow remote attackers to read arbitrary files. The available connected sources (NVD, CVE listings) confirm the affected pro...

phpix 1.0 - Directory Traversal

source: https://www.securityfocus.com/bid/1773/info PHPix is a web-based photo-album system written in PHP. It is vulnerable to an attack that allows a malicious remote user to view arbitrary files on the target webserver with the privileges of the webserver. The problem is that "../" character...

Mandrake 6.17.07.1 - perl HTTP Directory Disclosure

Mandrake 6.17.07.1 - perl HTTP Directory Disclosure source: https://www.securityfocus.com/bid/1678/info The default configuration files for versions of modperl shipped with Mandrake Linux 6.1 through 7.1 contain a misconfiguration that can be a security concern in some situations. The /perl...

nathan purciful phpphotoalbum 0.9.9 - Directory Traversal

source: https://www.securityfocus.com/bid/1650/info The explorer.php script within phpPhotoAlbum 0.9.9 and possibly previous versions are vulnerable to directory traversal. By requesting a URL composed of explorer.php and the ../ string in the value of the "folder" variable it is possible for a...

Дырка в Bajie Webserver

Можно узнать физическое расположение файлов, а обратный путь в директории позволяет получить доступ к любому файлу в системе...

Roxen WebServer 2.0.x - %00 Request FileDirectory Disclosure

Roxen WebServer 2.0.x - %00 Request FileDirectory Disclosure source: https://www.securityfocus.com/bid/1510/info If a request containing the null character %00 is made to the Roxen Web Server, the server will return directory contents, and the source of unparsed scripts and html pages. For exampl...

Roxen WebServer 2.0.x - '%00' Request File/Directory Disclosure

source: https://www.securityfocus.com/bid/1510/info If a request containing the null character %00 is made to the Roxen Web Server, the server will return directory contents, and the source of unparsed scripts and html pages. For example, a request to http://www.server.com/%00 Will return the...