Searching nonexistent software vulnerabilities

The W3C CERN httpd HTTP server allows remote at

nonexistent | attackers | determine | pathnames | commands | request | server | allows | remote | httpd | some | HTTP | real | CERN | URL | W3C | via |

The W3C CERN httpd HTTP server allows remote attackers to determine the real pathnames of some commands via a request for a nonexistent URL.


The Snoop servlet in Jakarta Tomcat 3.1 and 3.0

information | nonexistent | sensitive | extension | attacker | requests | servlet | Jakarta | reveals | remote | Tomcat | Apache | system | Snoop | under | snp | URL |

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.


document.d2w CGI program in the IBM Net.Data db

nonexistent | documentd2w | attackers | determine | physical | package | program | command | NetData | sending | server | allows | db2www | remote | path | CGI | IBM | web |

document.d2w CGI program in the IBM Net.Data db2www package allows remote attackers to determine the physical path of the web server by sending a nonexistent command to the program.


Lotus Domino server 5.0.8 with NoBanner enabled

server | Domino | Lotus |

Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine the physical path of the server via a request for a nonexistent file with a .pl (Perl) extension, which leaks the pathname in the error message, or (2) make any request that causes an HTTP 500 error, which leaks the server's version name in the HTTP error message.


Thunderstone Texis CGI script allows remote att

Thunderstone | nonexistent | generates | attackers | includes | pathname | request | message | script | allows | remote | obtain | Texis | error | which | file | full | path | root | CGI | web | via |

Thunderstone Texis CGI script allows remote attackers to obtain the full path of the web root via a request for a nonexistent file, which generates an error message that includes the full pathname.


ImageFolio 2.23 through 2.27 allows remote atta

ImageFolio |

ImageFolio 2.23 through 2.27 allows remote attackers to obtain sensitive information via a nonexistent image category, which leaks the web root in the resulting error message.


The DNS server for Cisco Content Service Switch

Service | Content | Switch | server | Cisco | DNS |

The DNS server for Cisco Content Service Switch (CSS) 11000 and 11500, when prompted for a nonexistent AAAA record, responds with response code 3 (NXDOMAIN or "Name Error") instead of response code 0 ("No Error"), which allows remote attackers to cause a denial of service (inaccessible domain) by forcing other DNS servers to send and cache a request for a AAAA record to the vulnerable server.


InfoVista PortalSE 2.0 Build 20087 on Solaris 8

InfoVista | PortalSE | Build |

InfoVista PortalSE 2.0 Build 20087 on Solaris 8 allows remote attackers to obtain sensitive information by specifying a nonexistent server in the server field, which reveals the path in an error message.


Multiple cross-site scripting (XSS) vulnerabili

cross-site | scripting | Multiple |

Multiple cross-site scripting (XSS) vulnerabilities in Paul Smith Computer Services vCAP 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the statusmsg parameter in RegisterPage.cgi or (2) a URI corresponding to a nonexistent file. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


index.php in @lex Guestbook 4.0.1 allows remote

Guestbook | indexphp | @lex |

index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message.


Format string vulnerability in XM Easy Personal

vulnerability | Personal | Server | string | Format | Easy | FTP |

Format string vulnerability in XM Easy Personal FTP Server 5.2.1 allows remote attackers to cause a denial of service (application crash) via format string specifiers in the USER command or certain other available or nonexistent commands. NOTE: It was later reported that 5.3.0 is also vulnerable.


KarjaSoft Sami HTTP Server 2.0.1 allows remote

KarjaSoft | Server | HTTP | Sami |

KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number of requests for nonexistent objects.


The LLTD Mapper in Microsoft Windows Vista allo

relationships | nonexistent | attackers | Microsoft | topology | provided | network | differs | address | Bridge" | Windows | Source | Mapper | header | "Spoof | packet | attack | allows | remote | bridge | HELLO | field | using | spoof | hosts | Vista | LLTD | Real | BASE | into | map | MAC | aka |

The LLTD Mapper in Microsoft Windows Vista allows remote attackers to spoof hosts, and nonexistent bridge relationships, into the network topology map by using a MAC address that differs from the MAC address provided in the Real Source field of the LLTD BASE header of a HELLO packet, aka the "Spoof on Bridge" attack.


The AddResource function in server/dia/resource

server/dia/resourcec | AddResource | function | Network | System | Audio |

The AddResource function in server/dia/resource.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (server crash) via a nonexistent client ID.


BugHunter HTTP SERVER (httpsv.exe) 1.6.2 allows

BugHunter | SERVER | HTTP |

BugHunter HTTP SERVER (httpsv.exe) 1.6.2 allows remote attackers to cause a denial of service (application crash) via a large number of requests for nonexistent pages.


Fedora Commons before 2.2.1 does not properly h

Commons | before | Fedora |

Fedora Commons before 2.2.1 does not properly handle certain authentication requests involving Java Naming and Directory Interface (JNDI), related to (1) a nonexistent account name in combination with an empty password, which allows remote attackers to trigger a certain "unexpected / strange response" from an LDAP server, and (2) a reauthentication attempt that throws an exception, which allows remote attackers to trigger use of a cached authentication decision. NOTE: authentication can be bypassed by using vector 1 followed by vector 2, and possibly can be bypassed by using a single vector.


Babo Violent 2 2.08.00 and earlier allows remot

Violent | Babo |

Babo Violent 2 2.08.00 and earlier allows remote attackers to cause a denial of service (application crash) via (1) a value greater than 0x27 for the (a) 0xca, (b) 0xcb, (c) 0xcc, (d) 0xce, (e) 0xcf, or (f) 0xd0 data ID; (2) a nonexistent map name; or (3) a UDP packet that specifies a large data size.


Software vulnerabilities results 1 to 18 of 18     
Page: 1