Apache Error Log Escape Sequence Injection

The target is running an Apache web server which allows for the injection of arbitrary escape sequences into its error logs. An attacker might use this vulnerability in an attempt to exploit similar vulnerabilities in terminal emulators. OpenVAS has determined the vulnerability exists only by...

beaXSS.txt

I. DESCRIPTION A cross-site scripting issue affects the display of error events in the 'View Error Log' feature of BEA WebLogic Administration console. II. AFFECTED PRODUCTS BEA WebLogic 8.1 SP4 and previous. III. HOW TO VERIFY 1. Make a HTTP request containing XSS code to a target Web server $...

CVE-2005-0040

Multiple cross-site scripting XSS vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the 1 register a new user page, 2 User-Agent, or 3 Username, which is not properly quoted before sending to the error log...

CVE-2005-0040

Multiple cross-site scripting XSS vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the 1 register a new user page, 2 User-Agent, or 3 Username, which is not properly quoted before sending to the error log...

CVE-2005-0040

DotNetNuke (DNN) before 3.0.12 is affected by multiple XSS vulnerabilities (CVE-2005-0040) that allow remote attackers to inject script via (1) the register-a-new-user page, (2) the User-Agent header, and (3) the Username field, due to improper quoting before logging. Affected versions are

CVE-2004-1606

Affected software: SalesLogix 6.1; vulnerable component: slxweb.dll. Description from CVE entries: remote attackers can cause a denial of service (application crash) by sending an invalid HTTP request, with potential leakage of sensitive information via the ErrorLogMsg cookie. The connected docum...

CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

DEBIAN-CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

security flaw

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

Mandrake Linux Security Advisory : cups (MDKSA-2004:116)

Chris Evans discovered numerous vulnerabilities in the xpdf package, which also effect software using embedded xpdf code : Multiple integer overflow issues affecting xpdf-2.0 and xpdf-3.0. Also programs like cups which have embedded versions of xpdf. These can result in writing an arbitrary byte ...

CVE-2003-0020

CVE-2003-0020 concerns Apache HTTP Server: the product does not filter terminal escape sequences from error logs, enabling potential insertion of escape sequences into terminal emulators vulnerable to such sequences. Connected documents show multiple related CVEs affecting different Apache branch...

Apache < 1.3.31 / 2.0.49 Error Log Escape Sequence Injection

Binary data 1221.prm...

PHP 3.0.x < 3.0.17 / 4.0.x < 4.0.3 Error Log Command Injection

Binary data 1480.prm...

Mandrake Linux Security Advisory : apache-mod_perl (MDKSA-2004:046-1)

Four security vulnerabilities were fixed with the 1.3.31 release of Apache. All of these issues have been backported and applied to the provided packages. Thanks to Ralf Engelschall of OpenPKG for providing the patches. Apache 1.3 prior to 1.3.30 did not filter terminal escape sequences from its...

GLSA200403-04 Multiple security vulnerabilities in Apache 2

Gentoo Linux Security Advisory GLSA 200403-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Multiple security vulnerabilities in Apache 2

Background The Apache HTTP Server Project is an effort to develop and maintain an open-source HTTP server for modern operating systems. The goal of this project is to provide a secure, efficient and extensible server that provides services in tune with the current HTTP standards. Description Thre...

Moderate: Red Hat Security Advisory: apache security update

Updated Apache and modssl packages that fix several minor security issues are now available for Red Hat Enterprise Linux. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. Ben Laurie found a bug in the optional renegotiation code in modssl which can...