134 matches found
FreeBSD : ruby -- UTF-7 encoding XSS vulnerability in WEBrick (34e0316a-aa91-11df-8c2e-001517289bf8)
The official ruby site reports : WEBrick have had a cross-site scripting vulnerability that allows an attacker to inject arbitrary script or HTML via a crafted URI. This does not affect user agents that strictly implement HTTP/1.1, however, some user agents do not. %NASLMINLEVEL 70300 C Tenable...
CVE-2010-0541
CVE-2010-0541 : A cross-site scripting (XSS) vulnerability in the WEBrick HTTP server of Ruby on Apple Mac OS X 10.5.8 and 10.6 before 10.6.4 allows remote attackers to inject arbitrary script/HTML via a crafted URI that triggers a UTF-7 error page. The connected documents confirm the existence a...
CVE-2010-0541
Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...
CVE-2010-0541 Ruby WEBrick javascript injection flaw
Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...
Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities
The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4. Mac OS X 10.6.4 contains security fixes for the following components : - CUPS - DesktopServices - Flash Player plug-in - Folder Manager - Help Viewer - iChat - ImageIO - Kerberos - Kernel - libcurl - Network...
CVE-2004-0541
creationtimestamp| type| source ---|---|--- 2010-04-30 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/16847 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/proxy/squidntlmauthenticate.rb 2025-02-06 03:13:38+00:00|...
CVE-2009-0541
Multiple cross-site scripting XSS vulnerabilities in Magento 1.2.0 and 1.2.1.1 allow remote attackers to inject arbitrary web script or HTML via 1 the username field in an admin/ request to index.php, possibly related to the loginusername parameter and the app/code/core/Mage/Admin/Model/Session.p...
CVE-2009-0541
CVE-2009-0541 describes multiple cross-site scripting (XSS) vulnerabilities in Magento 1.2.0 and 1.2.1.1. The issue arises from insufficient input sanitization in three areas: (1) admin login via index.php (username field, likely login[username]); (2) admin forgot password flow via index.php (ema...
CVE-2009-0541
creationtimestamp| type| source ---|---|--- 2009-02-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/32808 2009-02-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/32809 2009-02-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/32810 2026-04-23...
CVE-2007-0541
The CVE-2007-0541 issue affects WordPress and relates to pingback requests. A remote attacker can determine whether a local file exists and may read portions of certain files by triggering pingback service calls that use a local pathname as the source URI. Different fault codes for existing vs. n...
Squid NTLM Authenticate Overflow
This is an exploit for Squid's NTLM authenticate overflow libntlmssp.c. Due to improper bounds checking in ntlmcheckauth, it is possible to overflow the 'pass' variable on the stack with user controlled data of a user defined length. Props to iDEFENSE for the advisory. This module requires...
Moderate: Red Hat Security Advisory: dia security update
Updated Dia packages that fix several buffer overflow bugs are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Dia drawing program is designed to draw various types of diagrams. Several format string flaws were found in the w...
CVE-2006-0541
The CVE-2006-0541 entry concerns Tachyon Vanilla Guestbook 1.0 beta, describing multiple cross-site scripting (XSS) vulnerabilities. The vulnerable component is the guestbook application; the root cause is not explicitly detailed in the provided documents, and the attack vectors are listed as unk...
Debian DSA-710-1 : gtkhtml - NULL pointer dereference
Alan Cox discovered a problem in gtkhtml, an HTML rendering widget used by the Evolution mail reader. Certain malformed messages could cause a crash due to a NULL pointer dereference. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
CVE-2005-0541
consoleConnect.jsp in Cyclades AlterPath Manager APM Console Server 1.2.1 allows remote attackers to connect to arbitrary consoles by modifying the consolename parameter...
CVE-2005-0541
The CVE-2005-0541 issue affects Cyclades AlterPath Manager (APM) Console Server 1.2.1. The vulnerability is in consoleConnect.jsp, where an attacker can modify the consolename parameter to connect to arbitrary consoles. The NVD entry lists a high base score of 7.5 (NETWORK, LOW complexity, no aut...
CVE-2004-0541
Buffer overflow in the ntlmcheckauth NTLM authentication function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password "pass" variable...
CVE-2004-0541
Buffer overflow in the ntlmcheckauth NTLM authentication function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password "pass" variable...
Fedora Core 1 : squid-2.5.STABLE3-2.fc1 (2004-163)
Mon Jun 07 2004 Jay Fenlason 7:2.5.STABLE3-2.fc1 - Backport patch for CVE-2004-0541: buffer overflow in ntlm auth helper. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...
CVE-2004-0541
Buffer overflow in the ntlmcheckauth NTLM authentication function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password "pass" variable...