CVE-2006-5033

Unspecified vulnerability in StoresAndCalendarsList.cgi in Paul Smith Computer Services vCAP 1.9.0 Beta and earlier allows remote attackers to cause a denial of service via the session parameter, possibly related to format string specifiers or malformed URL encoding...

My Gaming Ladder Combo System 7.0 - Remote Code Execution

!/usr/bin/perl Method found & Exploit scripted by nukedx Contacts ICQ: 10072 MSN/Main: [email protected] web: www.nukedx.com Original advisory: http://www.nukedx.com/?viewdoc=28 Usage: ladder.pl Dork: "Ladder Scripts by http://www.mygamingladder.com" 40.500 pages. use IO::Socket; if@ARGV \r\n";...

K-COLLECT CSV_DB.CGI 1.0i_DB.CGI 1.0 - Remote Command Execution

K-COLLECT CSVDB.CGI 1.0iDB.CGI 1.0 - Remote Command Execution // source: https://www.securityfocus.com/bid/14059/info CSVDB.CGI/iDB.CGI are affected by a remote command execution vulnerability. Specifically, an attacker can supply arbitrary commands prefixed with the '|' character through the...

URL-Encoding Problem in Finjan SurfinGate

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUMMARY - ------- The Finjan SurfinGate use web content filtering and internet access management for protecting the network. A vulnerability in the product allows you to bypass the access management. You can download files which are normally blocked...

security flaw

Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline "%0a" before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command...

CVE-2004-1166

CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline "%0a" before the FTP command, which causes the commands to be inserted into the resulting FTP...

CVE-2004-1165

Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline "%0a" before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command...

Debian DSA-168-1 : php - bypassing safe_mode, CRLF injection

Wojciech Purczynski found out that it is possible for scripts to pass arbitrary text to sendmail as commandline extension when sending a mail through PHP even when safemode is turned on. Passing 5th argument should be disabled if PHP is configured in safemode, which is the case for newer PHP...

Squid < 2.5.STABLE5 %xx URL Encoding ACL Bypass

Binary data 1212.prm...

iisPROTECT Encoded URL Authentication Bypass

The remote host is running iisPROTECT, an IIS add-on to protect pages served by the web server. iisPROTECT is affected by an authentication bypass vulnerability due to a failure to recognize basic URL encoding. A remote attacher can exploit this, via hex-encoding requested URLs, to read sensitive...

IISProtect 2.12.2 - Authentication Bypass

IISProtect 2.12.2 - Authentication Bypass source: https://www.securityfocus.com/bid/7661/info http://www.example.com/%70rotected/secret.html http://www.example.com/protected%2fsecret.html...

Opera 7 - Image Rendering HTML Injection

Opera 7 - Image Rendering HTML Injection source: https://www.securityfocus.com/bid/6756/info It has been reported that, when generating HTML to display images or embedded media, Opera does not correctly format the provided URL or sufficiently encode URLs to local files. As a result of this lack o...

Opera 7 - Image Rendering HTML Injection

source: https://www.securityfocus.com/bid/6756/info It has been reported that, when generating HTML to display images or embedded media, Opera does not correctly format the provided URL or sufficiently encode URLs to local files. As a result of this lack of sanitization Opera is vulnerable to HTM...

CVE-2002-2145

Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space %20 and a '.' %2e at the end of the filename...

CVE-2002-0922

CGIScript.net csNews.cgi allows remote attackers to obtain database files via a direct URL-encoded request to 1 default%2edb or 2 default%2edb.style, or remote authenticated users to perform administrative actions via 3 a database parameter set to default%2edb...

OmniHTTPd 1.1/2.0.x/2.4 - Sample Application URL Encoded Newline HTML Injection

source: https://www.securityfocus.com/bid/5572/info OmniHTTPD is a webserver for Microsoft Windows operating systems. OmniHTTPD supports a number of CGI extensions which provide dynamic content. A HTML injection vulnerability has been reported in the '/cgi-bin/redir.exe' sample CGI included with...

CVE-2002-0809

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the...

CGIScript.net csNews 1.0 - Double URL Encoding Unauthorized Administrative Access

CGIScript.net csNews 1.0 - Double URL Encoding Unauthorized Administrative Access source: https://www.securityfocus.com/bid/4993/info csNews is a script for managing news items on a website. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. Users with...

CGIScript.net csNews 1.0 - Double URL Encoding Unauthorized Administrative Access

source: https://www.securityfocus.com/bid/4993/info csNews is a script for managing news items on a website. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. Users with "public" access to the system may be able to view and modify some administration...

CVE-2001-1152: Undefined Security Weakness

Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorized web servers by modifying the requested URL, including 1 a // double slash, 2 a /SUBDIR/.. where the desired file is in the parentdir, 3 ...