Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Dwarf HTTP Server 1.3.2 allows remote attackers to obtain the source code of JSP files via (1) dot, (2) space, (3) slash, or (4) NULL characters in the filename extension of an HTTP request.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Dwarf HTTP Server源码泄漏及跨站脚本攻击漏洞
Vulnerability Description
Dwarf HTTP Server是一款简单易用的免费Web Server。 Dwarf HTTP Server中存在信息泄漏和跨站脚本攻击漏洞，如下： 1) 由于没有正确地验证URL中用户所提供的文件名扩展，导致攻击者可以通过包含有逗号、空格、斜线和空字符的特制请求从服务器检索JSP文件的源码。 2) 在向用户返回错误消息之前没有过滤URL的输入，导致攻击者可以在用户浏览器会话环境中执行任意HTML和脚本代码。
CVSS Information
N/A
Vulnerability Type
N/A