90
Reference Description
CVE-2000-0293 Filenames with spaces allow arbitrary file deletion when the product does not
properly quote them; some overlap with path traversal.
https://www.cve.org/CVERecord?id=CVE-2000-0293
CVE-2001-1567 "+" characters in query string converted to spaces before sensitive file/
extension (internal space), leading to bypass of access restrictions to the file.
https://www.cve.org/CVERecord?id=CVE-2001-1567
CVE-2002-0253 Overlaps infoleak
https://www.cve.org/CVERecord?id=CVE-2002-0253
CVE-2001-0446 Application server allows remote attackers to read source code for .jsp files by
appending a / to the requested URL.
https://www.cve.org/CVERecord?id=CVE-2001-0446
CVE-2004-0334 Bypass Basic Authentication for files using trailing "/"
https://www.cve.org/CVERecord?id=CVE-2004-0334
CVE-2001-0893 Read sensitive files with trailing "/"
https://www.cve.org/CVERecord?id=CVE-2001-0893
CVE-2001-0892 Web server allows remote attackers to view sensitive files under the document
root (such as .htpasswd) via a GET request with a trailing /.
https://www.cve.org/CVERecord?id=CVE-2001-0892
CVE-2004-1814 Directory traversal vulnerability in server allows remote attackers to read
protected files via .. (dot dot) sequences in an HTTP request.
https://www.cve.org/CVERecord?id=CVE-2004-1814
CVE-2002-1483 Read files with full pathname using multiple internal slash.
https://www.cve.org/CVERecord?id=CVE-2002-1483
CVE-1999-1456 Server allows remote attackers to read arbitrary files via a GET request with
more than one leading / (slash) character in the filename.
https://www.cve.org/CVERecord?id=CVE-1999-1456
CVE-2004-0578 Server allows remote attackers to read arbitrary files via leading slash (//)
characters in a URL request.
https://www.cve.org/CVERecord?id=CVE-2004-0578
CVE-2002-0275 Server allows remote attackers to bypass authentication and read restricted
files via an extra / (slash) in the requested URL.
https://www.cve.org/CVERecord?id=CVE-2002-0275
CVE-2004-1032 Product allows local users to delete arbitrary files or create arbitrary empty files
via a target filename with a large number of leading slash (/) characters.
https://www.cve.org/CVERecord?id=CVE-2004-1032
CVE-2002-1238 Server allows remote attackers to bypass access restrictions for files via an
HTTP request with a sequence of multiple / (slash) characters such as http://
www.example.com///file/.
https://www.cve.org/CVERecord?id=CVE-2002-1238
CVE-2004-1878 Product allows remote attackers to bypass authentication, obtain sensitive
information, or gain access via a direct request to admin/user.pl preceded by //
(double leading slash).
https://www.cve.org/CVERecord?id=CVE-2004-1878
CVE-2005-1365 Server allows remote attackers to execute arbitrary commands via a URL with
multiple leading "/" (slash) characters and ".." sequences.
https://www.cve.org/CVERecord?id=CVE-2005-1365
CVE-2000-1050 Access directory using multiple leading slash.
https://www.cve.org/CVERecord?id=CVE-2000-1050
CVE-2001-1072 Bypass access restrictions via multiple leading slash, which causes a regular
expression to fail.
https://www.cve.org/CVERecord?id=CVE-2001-1072
CVE-2004-0235 Archive extracts to arbitrary files using multiple leading slash in filenames in
the archive.
CWE Version 4.14
CWE-41: Improper Resolution of Path Equivalence
CWE-41: Improper Resolution of Path Equivalence