CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

PYSEC-2011-2

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service resource consumption via a URL associated with...

MyST BlogSite URL Redirect / Information Leakage

=============================== MyST BlogSite | Multiple Vulnerabilities =============================== 1. VULNERABILITY DESCRIPTION -- Issue Title: Arbitrary URL Redirect Component: MyST BlogSite ClickDirector Ref: OWASP - Top 10 - 2010 - A10 Ref-Link:...

Apple Developer Cross Site Scripting / Redirect

Vulnerabilities via URL Redirector in developer.apple.com 1. VULNERABILITY DESCRIPTION Arbitrary URL Redirect ====================== POC Browsers: All https://developer.apple.com/membercenter/urlRedirect.action?fullURL=http://attacker.in/malwareexistsinthispage Issue References: OWASP Top 10 A10 ...

eGroupware 1.8.001.20110421 Open Redirect

------------------------------------------------------------------------ Software................eGroupware 1.8.001.20110421 Vulnerability...........Open Redirect Threat Level............Low 1/5 Download................http://www.egroupware.org/ Discovery Date..........5/19/2011 Tested...

eGroupWare 1.8.001.20110421 - Multiple Vulnerabilities

------------------------------------------------------------------------ Software................eGroupware 1.8.001.20110421 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.egroupware.org/ Discovery Date..........5/19/2011 Teste...

Java.com URL Redirect

================================== java.com | Arbitrary URL Redirect Vulnerability ================================== 1. VULNERABILITY DESCRIPTION - Arbitrary URL Redirect http://java.com/inc/BrowserRedirect1.jsp?locale=en&host=attacker.in Demo:...

CVE-2010-1543

Cross-site scripting XSS vulnerability in the eTracker module before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML by appending a crafted string to an arbitrary URL associated with the Drupal site...

Design/Logic Flaw

The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote...

CVE-2009-3735

The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote...

CVE-2009-3735

The CVE-2009-3735 entry concerns Panda ActiveScan: the ActiveScan Installer ActiveX control in as2stubie.dll (prior to v1.3.3.0) downloads as2guiie.cab from an arbitrary URL and does not verify the downloaded archive’s digital signature before installation, enabling remote code execution via a UR...

Maxthon Address Bar Spoofing Vulnerability

Maxthon Browser is prone to Address Bar Spoofing vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Avant Browser Address Bar Spoofing Vulnerability

Avant Browser is prone to Address Bar Spoofing vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the...

Design/Logic Flaw

Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site...

Design/Logic Flaw

Avant Browser 11.7 Builds 35 and 36 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the sit...

Design/Logic Flaw

Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containi...

CVE-2009-3006

Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site...

CVE-2009-0813: Improper Input Validation

Insecure method vulnerability in the ImeraIEPlugin ActiveX control ImeraIEPlugin.dll 1.0.2.54 in Imera TeamLinks Client allows remote attackers to force the download and execution of arbitrary URLs via modified DownloadProtocol, DownloadHost, DownloadPort, and DownloadURI parameters...