13 results (0.003 seconds)

CVSS: 5.8EPSS: 0%CPEs: 47EXPL: 1

CVE-2004-2763

https://notcve.org/view.php?id=CVE-2004-2763

The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting. La configuración por defecto de Sun ONE/iPlanet Web Server v4.1 SP! al SP2 y v6.0 SP1 al SP5 responde a las peticiones HTTP TRACE, lo que puede permitir a atacantes remotos el robo de información usando ataques de seguimiento de trazas en sitios cruzados (XST) en aplicaciones vulnerables a ataques de ejecución de secuencias de comandos en sitios cruzados. • http://archive.cert.uni-stuttgart.de/uniras/2004/02/msg00007.html http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf http://www.kb.cert.org/vuls/id/867593 • CWE-16: Configuration •

CVSS: 6.8EPSS: 0%CPEs: 21EXPL: 2

CVE-2007-0183 – iPlanet Web Server 4.1 - Search Module Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2007-0183

Cross-site scripting (XSS) vulnerability in /search in iPlanet Web Server 4.x allows remote attackers to inject arbitrary web script or HTML via the NS-max-records parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en /search en iPlanet Web Server 4.x permite a atacantes remotos inyectar scripts web o HTML de su elección a través del parámetro NS-max-records. NOTA: El origen de esta información es desconocido; los detalles se han obtenido solamente de información de terceros. • https://www.exploit-db.com/exploits/29439 http://osvdb.org/32662 http://secunia.com/advisories/23605 http://www.securityfocus.com/bid/21977 •

CVSS: 6.8EPSS: 3%CPEs: 12EXPL: 1

CVE-2002-1316

https://notcve.org/view.php?id=CVE-2002-1316

importInfo in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows the web administrator to execute arbitrary commands via shell metacharacters in the dir parameter, and possibly allows remote attackers to exploit this vulnerability via a separate XSS issue (CVE-2002-1315). importInfo en el Servidor de Administración de iPlanet WebServer 4.x hasta SP11, permite al adminstrador del web ejecutar comandos arbitrarios mediante metacaractéres de shell en el parámetro dir, y posiblemente permita a atacantes remotos explotar esta vulnerabilidad mediante otro problema de XSS (CAN-2002-13145) • http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0078.html http://marc.info/?l=bugtraq&m=103772308030269&w=2 http://sunsolve.sun.com/search/document.do?assetkey=1-26-49475-1 http://www.iss.net/security_center/static/10693.php http://www.ngsec.com/docs/advisories/NGSEC-2002-4.txt http://www.securityfocus.com/bid/6203 •

CVSS: 6.8EPSS: 78%CPEs: 12EXPL: 4

CVE-2002-1315

https://notcve.org/view.php?id=CVE-2002-1315

Cross-site scripting (XSS) vulnerability in the Admin Server for iPlanet WebServer 4.x, up to SP11, allows remote attackers to execute web script or HTML as the iPlanet administrator by injecting the desired script into error logs, and possibly escalating privileges by using the XSS vulnerability in conjunction with another issue (CVE-2002-1316). Vulnerabilidad de scripting en sitios cruzados (XSS) en el Servidor de Administración de iPlanet WebServer 4.x, hasta SP11, permite a usuarios remotos ejecutar scripts web o HTML como el adminstrador de iPlanet mediante la inyección del script deseado en los registros de errores, y posiblemente ganar más privilegios usando la vulnerabilidad XSS junto con otro problema (CAN-2002-1316) • http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0078.html http://marc.info/?l=bugtraq&m=103772308030269&w=2 http://sunsolve.sun.com/search/document.do?assetkey=1-26-49475-1 http://www.iss.net/security_center/static/10692.php http://www.ngsec.com/docs/advisories/NGSEC-2002-4.txt http://www.securityfocus.com/bid/6202 •

CVSS: 5.0EPSS: 32%CPEs: 26EXPL: 2

CVE-2002-1042 – iPlanet Web Server 4.1 - Search Component File Disclosure

https://notcve.org/view.php?id=CVE-2002-1042

Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows platforms, allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequences in the NS-query-pat parameter. • https://www.exploit-db.com/exploits/21603 http://archives.neohapsis.com/archives/bugtraq/2002-07/0085.html http://www.iss.net/security_center/static/9517.php http://www.securityfocus.com/bid/5191 •