Vulnerabilidades

MSHTML.DLL HTML parser in Internet Explorer 4.0, and other versions, allows remote attackers to cause a denial of service (application crash) via a script that creates and deletes an object that is associated with the browser window object.

IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests.

oidldapd 2.1.1.1 in Oracle 8.1.7 records log files in a directory (ldaplog) that has world-writable permissions, which may allow local users to delete logs and/or overwrite other files via a symlink attack.

Directory traversal vulnerability in commerce.cgi CGI program allows remote attackers to read arbitrary files via a .. (dot dot) attack in the page parameter.

IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially formatted URL's.

Internet Explorer 5.5 and earlier executes Telnet sessions using command line arguments that are specified by the web site, which could allow remote attackers to execute arbitrary commands if the IE client is using the Telnet client provided in Services for Unix (SFU) 2.0, which creates session transcripts.

Microsoft Internet Explorer 5.0 through 6.0 allows attackers to cause a denial of service (browser crash) via a crafted FTP URL such as "/.#./".

Funcionalidad HTML en Internet Explorer 5.5 y anteriores, que permite al atacante la ejecución de un archivo adjunto. Se consigue gracias al envío de cabeceras MIME inválidas para el adjunto que le permiten disfrazarse como un tipo de archivo no ejecutable. El correo electrónico vía HTML se representa en páginas web…

Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets (XSL) that are referenced using an IFRAME tag, possibly due to a vulnerability in Windows Scripting Host (WSH).

The ActiveX control for invoking a scriptlet in Internet Explorer 5.0 through 5.5 renders arbitrary file types instead of HTML, which allows an attacker to read arbitrary files, aka a variant of the "Scriptlet Rendering" vulnerability.

The Print Templates feature in Internet Explorer 5.5 executes arbitrary custom print templates without prompting the user, which could allow an attacker to execute arbitrary ActiveX controls, aka the "Browser Print Template" vulnerability.

Internet Explorer 5.0 through 5.5 allows remote attackers to read arbitrary files from the client via the INPUT TYPE element in an HTML form, aka the "File Upload via Form" vulnerability.

A function in Internet Explorer 5.0 through 5.5 does not properly verify the domain of a frame within a browser window, which allows a remote attacker to read client files, aka a new variant of the "Frame Domain Verification" vulnerability.

FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Malformed Web Form Submission" vulnerability.

IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the "File Fragment Reading via .HTR" vulnerability.

Microsoft IIS for Far East editions 4.0 and 5.0 allows remote attackers to read source code for parsed pages via a malformed URL that uses the lead-byte of a double-byte character.

Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same…

Buffer overflow in IIS ISAPI .ASP parsing mechanism allows attackers to execute arbitrary commands via a long string to the "LANGUAGE" argument in a script tag.

IIS 4.0 y 5.0 permite a atacantes remotos leer documentos fuera de la raíz web, y posiblemente ejecutar comandos arbitrarios, a través de URLs malformadas que contienen caracteres codificados en UNICODE, también conocida como la vulnerabilidad de 'recorrido de carpetas del servidor web'.

Vulnerabilidad de formato de cadena en x-gw en TIS Firewall Toolkit (FWTK) permite a usuarios locales ejecutar comandos arbitrarios mediante un nombre de visualización malformado.

Internet Explorer anterior a 5.5 reenvía las credenciales de usuario en caché para un sitio web seguro a páginas no seguras en el mismo sitio web, lo que podría permitir a atacantes remotos obtener las credenciales al monitorear las conexiones al servidor web, también conocida como la vulnerabilidad 'Cached Web…

IIS 5.0 permite a atacantes remotos ejecutar comandos arbitrarios a través de una solicitud malformada para un archivo ejecutable cuyo nombre se adjunta con comandos del sistema operativo, también conocida como la vulnerabilidad 'Web Server File Request Parsing'.

Las páginas .ASP de IIS 4.0 y 5.0 envían la misma cookie de ID de sesión para sesiones web seguras e inseguras, lo que podría permitir a atacantes remotos secuestrar la sesión web segura del usuario si ese usuario se mueve a una sesión insegura, también conocida como la vulnerabilidad 'Session ID Cookie Marking'.

Desbordamiento de búfer en oidldapd en Oracle 8.1.6 permite a usuarios locales obtener privilegios a través de un parámetro de línea de comandos 'connect' largo.

Una mala configuración en IIS 5.0 con Index Server habilitado y la propiedad Index establecida permite a atacantes remotos listar directorios en la raíz web a través de una búsqueda de Web Distributed Authoring and Versioning (WebDAV).