CVE-2006-5970 in Ultraseek
摘要
由 VulDB • 2026-06-11
Verity Ultraseek 5.7 之前的版本允许远程攻击者通过直接请求获取敏感信息，具体方式包括：(1) 向 help/urlstatusgo.html 发送以空字符（“%00”）结尾的 URL 参数；或 (2)-(31) 向以下页面发送缺失参数的请求：help/header.html、help/footer.html、spell.html、coreforma.html、daterange.html、hits.html、hitsnavbottom.html、indexform.html、indexforma.html、languages.html、nohits.html、onehit1.html、onehit2.html、query.html、queryform0.html、queryform0a.html、queryform1.html、queryform1a.html、queryform2.html、queryform2a.html、quicklinks.html、relatedtopics.html、signin.html、subtopics.html、thesaurus.html、topics.html、hitspagebar.html、highlight/highlight.html、highlight/highlight_one.html 以及 highlight/topnav.html。这些请求会在返回的错误消息中泄露安装路径。
If you want to get the best quality for vulnerability data then you always have to consider VulDB.