Menu

Search for hundreds of thousands of exploits

"W3Mail 1.0.6 - File Disclosure"

Author

Exploit author

"Tim Brown"

Platform

Exploit platform

cgi

Release date

Exploit published date

2002-11-12

Download file

1
2
3
4
5
source: https://www.securityfocus.com/bid/6170/info

Versions of W3Mail 1.0.6 and greater are susceptible to a file disclosure vulnerability. To view attachments, the script "viewAttachment.cgi" accepts the parameter "file". The value of this parameter is passed to the open() function as the filename argument without being sanitized. Attackers may cause any file on the filesystem to open by specifying its relative path using directory traversal characters. 

viewAttachment.cgi?file=../../../../../etc/passwd
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-11-19 "Gemtek WVRTM-127ACN 01.01.02.141 - Authenticated Arbitrary Command Injection" webapps cgi "Gabriele Zuddas"
2020-10-29 "Mailman 1.x > 2.1.23 - Cross Site Scripting (XSS)" webapps cgi "Valerio Alessandroni"
2020-04-23 "Zen Load Balancer 3.10.1 - Directory Traversal (Metasploit)" webapps cgi "Dhiraj Mishra"
2020-04-10 "Zen Load Balancer 3.10.1 - 'index.cgi' Directory Traversal" webapps cgi "Basim Alabdullah"
2020-03-30 "Zen Load Balancer 3.10.1 - Remote Code Execution" webapps cgi "Cody Sixteen"
2020-02-11 "CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting" webapps cgi Luca.Chiou
2019-09-09 "Rifatron Intelligent Digital Security System - 'animate.cgi' Stream Disclosure" webapps cgi LiquidWorm
2019-07-12 "Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass / Remote Command Execution" webapps cgi "Chris Lyne"
2019-02-18 "Master IP CAM 01 3.3.4.2103 - Remote Command Execution" webapps cgi "Raffaele Sabato"
2019-02-11 "IPFire 2.21 - Cross-Site Scripting" webapps cgi "Ozer Goker"
Release Date Title Type Platform Author
2012-11-01 "Konqueror 4.7.3 - Memory Corruption" dos linux "Tim Brown"
2011-06-30 "IBM DB2 - 'DT_RPATH' Insecure Library Loading Arbitrary Code Execution" remote multiple "Tim Brown"
2011-01-31 "OpenVAS Manager - Command Injection" local linux "Tim Brown"
2010-02-10 "Accellion Secure File Transfer Appliance - Multiple Command Restriction Weakness Privilege Escalations" local linux "Tim Brown"
2010-02-10 "Accellion File Transfer - 'Appliance web_client_user_guide.html?lang' Traversal Arbitrary File Access" remote linux "Tim Brown"
2009-10-27 "KDE 4.3.2 - Multiple Input Validation Vulnerabilities" remote linux "Tim Brown"
2007-11-23 "Bandersnatch 0.4 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities" webapps php "Tim Brown"
2007-07-27 "Bandersnatch 0.4 - Multiple Input Validation Vulnerabilities" webapps php "Tim Brown"
2007-07-10 "ImgSvr 0.6 - 'Template' Local File Inclusion" webapps linux "Tim Brown"
2007-06-11 "JFFNms 0.8.3 - 'admin/setup.php' Direct Request Authentication Bypass" webapps php "Tim Brown"
2007-06-11 "JFFNms 0.8.3 - 'auth.php' Multiple SQL Injections" webapps php "Tim Brown"
2007-06-11 "JFFNms 0.8.3 - 'admin/adm/test.php' PHP Information Disclosure" webapps php "Tim Brown"
2007-06-11 "JFFNms 0.8.3 - 'auth.php?user' Cross-Site Scripting" webapps php "Tim Brown"
2007-05-03 "D-Link DSL-G624T - Var:RelaodHref Cross-Site Scripting" remote hardware "Tim Brown"
2002-11-12 "W3Mail 1.0.6 - File Disclosure" webapps cgi "Tim Brown" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected