Microsoft Internet Explorer Zone拒绝服务漏洞

BUGTRAQ ID: 24744 CNCAN ID:CNCAN-2007070410 Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Internet Explorer处理使用不同参数子域的域名存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 问题存在于当在Intranet区域和限制区域中使用不同字符 ,.，浏览器处理带有不同参数的sub domains的域名会出现奇怪的行为，打开这些WEB站点会导致过量使用CPU而造成拒绝服务攻击。 Microsoft Internet Explorer 6.0 SP2 Microso...

[Full-disclosure] Advisory : Internet Explorer Zone Domain Specification Dos and Page suppressing.

Advisory : Internet Explorer Zone Domain Specification Dos and Page Suppressing Severity : Intermediate Version : IE 6.0 - 7.0 Dated : 18 June 2007 Explanation: The vulnerability is present in handling of domain names with different parameters sub domains when specified in the Intranet zone and...

Low: Red Hat Bug Fix Advisory: htdig bug fix update

An updated htdig package that fix various bugs is now available. The htdig system is a complete world wide web indexing and searching system for a small domain or intranet. This system is not meant to replace the need for powerful internet-wide search systems like Lycos, Infoseek, Webcrawler and...

Allow embedding multimedia content located on remote servers

Re: CSP-8387 Currently, when embedding multimedia content on Confluence you are restricted to embedding files located on the Confluence server. The page http://confluence.atlassian.com/display/CONF20/Embedding+Multimedia+Content singles out "security reasons" as the reason for this limitation. In...

Softerra Time-Assistant 6.2 - inc_dir Remote File Inclusion

Softerra Time-Assistant 6.2 - incdir Remote File Inclusion \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV80$2007 ----------------------------------------------------------------------------------------- ECHOADV80$2007 Softerra Time-Assistant = 6.2 incdir...

C-Arbre <= 0.6PR7 (root_path) Remote File Inclusion Vulnerability

No description provided by source. \ /\ / | \ | / // / | | \ \ Y / | / / \ /\| /\ / / / / / .OR.ID ECHOADV78$2007 ----------------------------------------------------------------------------------------- ECHOADV78$2007 C-Arbre = 0.6PR7 rootpath Remote File Inclusion Vulnerability...

C-Arbre <= 0.6PR7 (root_path) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================= C-Arbre = 0.6PR7 rootpath Remote File Inclusion Vulnerability ================================================================= \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / |...

CVE-2007-0116

Digger Solutions Intranet Open Source IOS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for data/intranet.mdb...

CVE-2007-0116

Digger Solutions Intranet Open Source IOS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for data/intranet.mdb...

CVE-2007-0116

The CVE-2007-0116 issue affects Digger Solutions Intranet Open Source (IOS). The vulnerability arises from storing sensitive information under the web root with insufficient access control, enabling remote attackers to download a database containing passwords by directly requesting data/intranet....

SOL6924 - Insertion of special characters in URL path circumvents Accessibility Scope and Access Control Lists

It is possible to bypass the Deny list, configured in the Accessibility Scope section located on the Portal Access: Web Applications: Master Group Settings page, by inserting certain special characters into a URL path. In FirePass version 6.0, this issue also applies to the Deny list configured...

Intranet Open Source Remote Password Disclosure &quot;intranet.mdb&quot;

ARIA-SECURITY TEAM Forum: http://aria-security.com Discovered by:Aria-Security Team Type:Remote Password Disclosure Vendor:http://diggersolutions.com/blogs/diggersolutions/default.aspx PoC: http://victim.com/path/data/intranet.mdb Contact: [email protected]...

SOL6922 - Decimal-encoded IP address circumvents Accessibility Scope

It is possible to bypass the Deny list configured in the Accessibility Scope section of the Portal Access: Web Applications: Master Group Settings page using a URL with a decimal-encoded IP address. When you log in to the FirePass Webtop, you can enter a URL into the Webtop Address Bar if the...

CVE-2005-4822

Digger Solutions Intranet Open Source (IOS) 2.7.2 contains an SQL injection in projects/project-edit.asp via the project_id parameter. This allows remote attackers to execute arbitrary SQL commands. Exploitation details are not provided in the documents; no confirmed in-the-wild exploit data is l...

Microsoft Visual Studio “WMI Object Broker”控件代码执行漏洞（MS06-073）

Microsoft Visual Studio是微软公司的开发工具套件系列产品，是一个基本完整的开发工具集，包括了软件整个生命周期中所需要的大部分工具。 Visual Studio的"WMI Object Broker"控件在例程的创建和处理上存在漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意恶意代码。 Visual Studio所捆绑的WMI Object Broker ActiveX控件允许创建系统上已有的ActiveX控件例程。以这种方式创建的ActiveX对象会绕过ActiveX安全限制，如忽略kill bit和safe for...

Owl Intranet引擎SQL注入漏洞

Owl Intranet Engine是一款基于PHP的开放源代码的发表文件/文档的知识库系统。 Owl Intranet Engine不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可以获得敏感信息。 问题是'lib/owl.lib.php'脚本对用户提交的WEB参数缺少过滤，提交恶意的SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Owl Owl Intranet Engine 0.80 Owl Owl Intranet Engine 0.73 Owl Owl Intranet Engine 0.72 Owl Owl Intranet...

CVE-2006-6264

Teredo creates trusted peer entries for arbitrary incoming source Teredo addresses, even if the low 32 bits represent an intranet address, which might allow remote attackers to send IPv4 traffic to intranet hosts that use non-RFC1918 addresses, bypassing IPv4 ingress filtering...

CVE-2006-4561

Mozilla Firefox 1.5.0.6 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker's...

CVE-2006-4560

Internet Explorer 6 on Windows XP SP2 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under t...

PT-2006-5353 · Microsoft · Internet Explorer 6

Name of the Vulnerable Software and Affected Versions: Internet Explorer 6 version Description: The issue allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server. This can be achieved by hosting script on an Internet we...