Design/Logic Flaw

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

CVE-2016-0793

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

UBUNTU-CVE-2015-1269

The DecodeHSTSPreloadRaw function in net/http/transportsecuritystate.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string...

chromium-browser: Normalization error in HSTS/HPKP preload list

The DecodeHSTSPreloadRaw function in net/http/transportsecuritystate.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string...

[SECURITY] Fedora 20 Update: pwgen-2.07-1.fc20

pwgen generates random, meaningless but pronounceable passwords. These passwords contain either only lowercase letters, or upper and lower case, or upper case, lower case and numeric digits. Upper case letters and numeric digits are placed in a way that eases memorizing the password...

Password Security Scanner - Check the security/strength of your passwords on Windows

This utility scans the passwords stored by popular Windows applications Microsoft Outlook, Internet Explorer, Mozilla Firefox, and more... and displays security information about all these passwords. The security information of every stored password includes the total number of characters, number...

DEBIAN-CVE-2012-2654

The 1 EC2 and 2 OS APIs in OpenStack Compute Nova Folsom 2012.2, Essex 2012.1, and Diablo 2011.3 do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restriction...

PYSEC-2012-37

The 1 EC2 and 2 OS APIs in OpenStack Compute Nova Folsom 2012.2, Essex 2012.1, and Diablo 2011.3 do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restriction...

perl: lc(), uc() routines are laundering tainted data

The 1 lc, 2 lcfirst, 3 uc, and 4 ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection...

JQL breaks issue security levels based on custom fields

The MultiSelectCustomFieldIndexer does 2 things: index but don't store a case-folded version in the field "customfield10017:retail" store a "raw" version in a new field with the raw added to the end "customfield10017raw:Retail" The problem is that com.atlassian.jira.security.type.GroupCF looks fo...

OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,6660049,6660539,6813167)

Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to 1 LayoutQueue, 2 Cursor.predefined, 3...

Fedora 9 : bitlbee-1.2.2-1.fc9 (2008-7274)

Upstream released Bitlbee 1.2.2 with the following changes to the former release: - Security bugfix: It was possible to hijack accounts without gaining access to the old account, it's simply an overwrite - Some more stability improvements. - Fixed bug where people with non-lowercase nicks couldn'...

Joomla! 1.5 Beta1/Beta2/RC1 - SQL Injection

!/usr/bin/php -q -d shortopentag=on getPageParameters; switch $params-get'filtertype', 'title' case 'title' : $where .= ' AND LOWER a.title LIKE '%'.$filter.'%''; break; case 'author' : $where .= ' AND LOWER u.name LIKE '%'.$filter.'%' OR LOWER a.createdbyalias LIKE '%'.$filter.'%' '; break;...

corehttp-overflow.txt

/ corehttpv0.5.3alpha: httpd remote buffer overflow exploit. by: vade79/v9 [email protected] fakehalo/realhalo compile: gcc xcorehttp.c -o xcorehttp syntax: ./xcorehttp -r -h host -p port corehttp homepage/url: http://corehttp.sourceforge.net/ bughttp.c:...

CoreHTTP 0.5.3alpha - HTTPd Remote Buffer Overflow

CoreHTTP 0.5.3alpha - HTTPd Remote Buffer Overflow / corehttpv0.5.3alpha: httpd remote buffer overflow exploit. by: vade79/v9 [email protected] fakehalo/realhalo compile: gcc xcorehttp.c -o xcorehttp syntax: ./xcorehttp -r -h host -p port corehttp homepage/url: http://corehttp.sourceforge.net/...

CVE-2004-2154

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive...

CVE-1999-0239

CVE-1999-0239 affects Netscape FastTrack Web Server. When a remote client issues a request using a lowercase “get” command instead of an uppercase GET, the server may return a directory listing rather than a protected default page (e.g., index.html). This results in an information-disclosure cond...

CVE-1999-0239

Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET...

CVE-1999-0239

Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET...

PT-1998-1044 · Netscape · Netscape Fasttrack Web Server

Name of the Vulnerable Software and Affected Versions: Netscape FastTrack Web server affected versions not specified Description: The issue allows the listing of files when a lowercase "get" command is used instead of an uppercase GET. Recommendations: At the moment, there is no information about...