441 matches found
Radancy: Application error message
Attack details HTTP Header input X-Forwarded-For was set to 12345'"'";|%00%0d%0a%bf%27'??? Error message found: Warning: inetpton function.inet-pton: Unrecognized address 12345'"\'\";|%00%0d%0a%00%bf%27' in...
Regular Expression Denial of Service
Overview Affected versions of negotiator are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted Accept-Language header value. Recommendation Update to version 0.6.1 or later. References GitHub Advisory...
WPML 2.9.3-3.2.6 - Cross-Site Scripting (XSS) in Accept-Language Header
The sitepress-multilingual-cms WordPress plugin was affected by a Cross-Site Scripting XSS in Accept-Language Header security vulnerability...
IBM Content Navigator Cross-Site Scripting Vulnerability
IBM Content Navigator is a Web client from IBM USA that supports searching and processing documents stored in content servers around the world from a Web browser. A cross-site scripting vulnerability exists in IBM Content Navigator, which can be exploited by remote attackers to inject arbitrary w...
Cross site scripting
Cross-site scripting XSS vulnerability in IBM Content Navigator 2.0.0 and 2.0.1 before 2.0.1.2 FP002 IF003 and 2.0.3 before 2.0.3.2 FP002 allows remote attackers to inject arbitrary web script or HTML via the Accept-Language HTTP header...
CVE-2014-8911
Cross-site scripting XSS vulnerability in IBM Content Navigator 2.0.0 and 2.0.1 before 2.0.1.2 FP002 IF003 and 2.0.3 before 2.0.3.2 FP002 allows remote attackers to inject arbitrary web script or HTML via the Accept-Language HTTP header...
PT-2015-4118
Name of the Vulnerable Software and Affected Versions IBM Content Navigator versions 2.0.0 through 2.0.1 before 2.0.1.2 FP002 IF003 IBM Content Navigator versions 2.0.3 before 2.0.3.2 FP002 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML...
CVE-2014-8911: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in IBM Content Navigator 2.0.0 and 2.0.1 before 2.0.1.2 FP002 IF003 and 2.0.3 before 2.0.3.2 FP002 allows remote attackers to inject arbitrary web script or HTML via the Accept-Language HTTP header...
Cart Engine 3.0 - Multiple Vulnerabilities
=== Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially crafted HTTP request, it is possible to exploi...
phpLDAPadmin 0.9.4b DoS
No description provided by source. / Exploit Title: phpLDAPadmin 0.9.4b DoS Google Dork: phpLDAPadmin - 0.9.4b Date: 2011-10-23 Author: Alguien Software Link: http://sourceforge.net/projects/phpldapadmin/files/phpldapadmin/0.9.4b/ Version: 0.9.4b Tested on: Red Hat CVE : - Compilation: ----------...
IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow
No description provided by source. $Id: dominohttpacceptlanguage.rb 10998 2010-11-11 22:43:22Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...
Neon WebDAV Client Library 0.2x Format String Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/10136/info It has been reported that the Neon client library is prone to multiple remote format string vulnerabilities. This issue is due to a failure of the application to properly implement format string functions...
The browser cache is Vary broken
Jake, why are your blog posts always so depressing? -- Domenic Denicola @domenic Well, I wouldn't want to disappoint… TL;DR If you use "Vary" to negotiate content, the responses will fight for the same cache space. Additionally, IE ignores "max-age" and Safari is buggy. Content negotiation using...
Squid Accept-Language Header DoS Vulnerability (SQUID-2013:1)
Squid is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:squid-cache:squid";...
CVE-2013-1839
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a "," character in an Accept-Language header...
CVE-2013-1839
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a "," character in an Accept-Language header...
CVE-2013-1839
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a "," character in an Accept-Language header...
CVE-2013-1839
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a "," character in an Accept-Language header...
CVE-2013-1839
Removed by vendor...
CVE-2013-1839: Improper Input Validation
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a "," character in an Accept-Language header...