829 matches found
Directory traversal
Directory traversal vulnerability in install05.php in Simple PHP Blog SPB 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the bloglanguage parameter, as demonstrated by injecting PHP sequences in...
CVE-2006-0644
Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS aka CPG Dragonfly CMS 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in 1 the newlang parameter and 2 the installlang...
MSDTC denial of service by flooding with nul bytes
It was possible to crash the MSDTC service by sending 20200 nul bytes. OpenVAS Vulnerability Test $Id: msdtcdos.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: MSDTC denial of service by flooding with nul bytes Authors: Michel Arboi Copyright: Copyright C 2002 Michel Arboi This program is fr...
GLSA-200403-11 : Squid ACL [url_regex] bypass vulnerability
The remote host is affected by the vulnerability described in GLSA-200403-11 Squid ACL urlregex bypass vulnerability A bug in Squid allows users to bypass certain access controls by passing a URL containing '%00' which exploits the Squid decoding function. This may insert a NUL character into...
NUL Character in message body locks up Outlook/Outlook Express
Hello, A number of Microsoft mail programs fail when they attempt to download a message containing ASCII NUL in the message body. The clients we tested are: Outlook Express 6.00.2800.1106 Outlook 2002 10.2627.3501 SP-1 Outlook 2003 11.5608.5606 Once the client attempts to download the particular...
Squid ACL [url_regex] bypass vulnerability
Background Squid is a fully-featured Web Proxy Cache designed to run on Unix systems that supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features. Description A bug in Squid allows use...
squid ACL bypass due to URL decoding bug
From the Squid advisory: Squid versions 2.5.STABLE4 and earlier contain a bug in the "%xx" URL decoding function. It may insert a NUL character into decoded URLs, which may allow users to bypass urlregex ACLs...
CVE-2003-0465
The CVE-2003-0465 issue affects the Linux kernel (2.4/2.5) where strncpy does not pad with null bytes on architectures other than x86, potentially allowing information leaks. Red Hat’s RHSA-2004:188 and related advisories document this as a kernel vulnerability with fixes in updated kernel packag...
