CVE-2012-0036

CVE-2012-0036 affects curl/libcurl 7.2x prior to 7.24.0. The issue arises from not correctly handling special characters when extracting a URL pathname, enabling data-injection via crafted URLs and enabling CRLF injection in IMAP/POP3/SMTP paths. The CVSS metrics in the record show a Base score o...

CVE-2012-0036

curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the 1 IMAP, 2 POP3, or 3 SMTP protocol...

CVE-2012-0036

curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the 1 IMAP, 2 POP3, or 3 SMTP protocol...

CVE-2012-0036: Improper Neutralization of Special Elements used in an SQL Command

curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the 1 IMAP, 2 POP3, or 3 SMTP protocol...

curl data injection

Data injection via request URL...

USN-1346-1: curl vulnerability

Dan Fandrich discovered that curl incorrectly handled URLs containing embedded or percent-encoded control characters. If a user or automated system were tricked into processing a specially crafted URL, arbitrary data could be injected...

URL sanitization vulnerability

curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs. When parsing URLs, libcurl's parser is liberal and only parses as little as possible and lets as much as possible through as long as it can figure out what to do. In...

PT-2012-1100

Name of the Vulnerable Software and Affected Versions curl versions prior to 7.24.0 Description The issue concerns the improper handling of special characters during pathname extraction from URLs, allowing remote attackers to conduct data-injection attacks. This can be exploited through crafted...

CVE-2012-0036

curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the 1 IMAP, 2 POP3, or 3 SMTP protocol...

Ajax File and Image Manager 1.0 Final - Remote Code Execution

Ajax File and Image Manager 1.0 Final - Remote Code Execution -------------------------------------------------------------------------- Ajax File and Image Manager v1.0 Final Remote Code Execution Vulnerability --------------------------------------------------------------------------...

Fedora Update for glpi-data-injection FEDORA-2011-9690

Check for the Version of glpi-data-injection OpenVAS Vulnerability Test Fedora Update for glpi-data-injection FEDORA-2011-9690 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/o...

Fedora Update for glpi-data-injection FEDORA-2011-9690

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

[SECURITY] Fedora 14 Update: glpi-data-injection-2.0.2-1.fc14

Plugin for importing data into GLPI It'll can serve, for example, to : - import machines at the delivery electronic delivery order in CSV - import additional data - import equipment not managed by OCS - transmit from an other tool of asset management...

[SECURITY] Fedora 14 Update: glpi-data-injection-2.0.2-1.fc14

Plugin for importing data into GLPI It'll can serve, for example, to : - import machines at the delivery electronic delivery order in CSV - import additional data - import equipment not managed by OCS - transmit from an other tool of asset management...

perl multiple security vulnerabilities

Data injection and protection bypass in lc, lcfirst, uc, ucfirst functions and CGI module...

Mandriva Update for glpi-data-injection MDVA-2011:015 (glpi-data-injection)

Check for the Version of glpi-data-injection OpenVAS Vulnerability Test Mandriva Update for glpi-data-injection MDVA-2011:015 glpi-data-injection Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

Mandriva Update for glpi-data-injection MDVA-2011:015 (glpi-data-injection)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Design/Logic Flaw

PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an...

CVE-2010-3618

CVE-2010-3618 affects PGP Desktop versions 10.0.x prior to 10.0.3 SP2 and 10.1.0 prior to 10.1.0 SP1. The vulnerability lies in the Decrypt/Verify File via Right-Click workflow for multi-packet OpenPGP messages, enabling a remote attacker to spoof signed data by appending an unsigned/extra messag...

PT-2010-4958

Name of the Vulnerable Software and Affected Versions PGP Desktop versions 10.0.x through 10.0.3 SP1 PGP Desktop version 10.1.0 Description The issue is related to the improper implementation of the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages. This allows...