Firefox errors parsing URLs with control characters

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks...

Errors parsing URLs with leading whitespace and control characters — Mozilla

Perl developer Chip Salzenberg reported that certain control characters, when placed at the beginning of a URL, would lead to incorrect parsing resulting in a malformed URL being output by the parser. IBM researchers Justin Schuh, Tom Cross, and Peter William also reported a related symptom as pa...

CVE-2008-4188

Unspecified vulnerability in the TYPO3 Secure Directory kwsecdir extension before 1.0.2 allows remote attackers to execute arbitrary code via unknown vectors related to "injection of control characters."...

CVE-2008-4188

Unspecified vulnerability in the TYPO3 Secure Directory kwsecdir extension before 1.0.2 allows remote attackers to execute arbitrary code via unknown vectors related to "injection of control characters."...

FreeBSD Ports: lighttpd

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Code injection

Soldat game server 1.4.2 and earlier, and dedicated server 2.6.2 and earlier, allows remote attackers to cause a client denial of service crash via 1 a long string to the file transfer port or 2 a long chat message, or 3 a server denial of service continuous beep and slowdown via a string...

MOPB-34-2007:PHP mail() Header Injection Through Subject and To Parameters

Summary The mail function converts control characters like linefeed or carriage return in the Subject and To parameters into spaces as a protection against email header injection. However an exception is made for folded mail headers that continue on the next line. Unfortunately the macro handling...

CVE-2005-3704

CVE-2005-3704 describes a vulnerability in Mac OS X and OS X Server versions 10.4 through 10.4.3 where a remote attacker can spoof syslog messages by injecting control characters (e.g., newline) into log files. The description specifies this affects the system log server and enables manipulation ...

CVE-2005-3704

System log server in Mac OS X and OS X Server 10.4 through 10.4.3 allows remote attackers to spoof syslog messages in log files by injecting various control characters such as newline NL...

security flaw

wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code...

Enterasys Vertical Horizon switches backdoor accounts

There is undocumented backdoor account tiger/tiger123, in addition some privileged control character combination are available to unprivileged user from console or telnet session...

DEBIAN-CVE-2004-1488

wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code...

CVE-2002-0986

CVE-2002-0986 corresponds to a PHP 4.x vulnerability where mail() did not filter ASCII control characters from arguments, allowing remote attackers to modify mail content including headers and potentially use the server as a spam proxy. The OpenVAS entries confirm the issue arises on PHP

CVE-2004-0478

The CVE-2004-0478 entry describes a DoS flaw in Mozilla where JavaScript can trigger an infinite loop that appends input to a form (potentially via control characters such as an embedded ctrl-U), causing high CPU/RAM usage. Affected versions are not precisely specified; the impact is denial of se...

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)

Westpoint Security Advisory Title: VisitorBook LE Mail Relay and Cross Site Scripting Risk Rating: Moderate Software: FreeScripts VisitorBook LE Platforms: Most Unix Vendor URL: http://www.freescripts.com/ Author: Paul Johnston [email protected] Date: 10th December 2003 Advisory ID: wp-03-000...

Low: Red Hat Security Advisory: apache security update for Stronghold

Updated Apache packages are available which fix a security issue by preventing control characters from being written to the error log. The updated packages also include a minor bug fix for modproxy. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. T...

(RHSA-2002:214) php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP server. The mail function in PHP 4.x to 4.2.2 may allow local script authors to bypass safe mode restrictions and modify command line arguments to the MTA such as sendmail in the 5th argument to mail, altering MTA...

security flaw

The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."...

security flaw

The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."...

security flaw

The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."...