499 matches found
CVE-2004-1020
The addslashes function in PHP 4.3.9 does not properly escape a NULL /0 character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magicquotesgpc...
CVE-2004-1020
The addslashes function in PHP 4.3.9 does not properly escape a NULL /0 character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magicquotesgpc...
CVE-2004-0189
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...
Netscape/Mozilla Null Character Cookie Disclosure (deprecated)
Binary data 1310.prm...
CVE-2004-0760
Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character %00 in an FTP URI...
CVE-2004-0760
Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character %00 in an FTP URI...
CVE-2004-0595
The striptags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null \0 characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and...
Fedora Core 1 : squid-2.5.STABLE3-1.fc1 (2004-104)
Tue Mar 09 2004 Jay Fenlason 7:2.5.STABLE3-1.fc1 - Backport security fix for %00 hole. See CVE-2004-0189: The '%xx' URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL '%00' character, which causes Squid to use only a portion...
CVE-2004-0632
CVE-2004-0632: Adobe Reader/Acrobat Reader 6.x is vulnerable to a buffer overflow caused by improper handling of NULL characters when splitting a filename path into components, allowing remote code execution via a crafted file with a long extension. The issue affects Adobe Reader 6.0 (and 6.0.x v...
PHP strip_tags protection bypass
Insertion null character into tag allow protection bypass for few browsers...
Outlook/Outlook Express NULL character DoS
Client hangs on POP3 receiving if message contains NULL character...
DEBIAN-CVE-2004-0189
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...
CVE-2004-0189
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...
CVE-2003-0975
Apple Safari 1.0 through 1.1 on Mac OS X 10.3.1 and Mac OS X 10.2.8 allows remote attackers to steal user cookies from another domain via a link with a hex-encoded null character %00 followed by the target domain...
CVE-2003-0768
CVE-2003-0768 concerns Microsoft ASP.NET 1.1. The description across provided sources states that remote attackers can bypass the Cross-Site Scripting (XSS) and Script Injection protection feature by injecting a null character at the beginning of a tag name. The connected documents confirm the af...
ASP.NET crossite scripting protection bypass
It's possible to insert null character after tag opening...
Advisory: Incorrect Handling of XSS Protection in ASP.Net
Monday, September 8th, 2003 Background: ---------- As part of Microsoft's attempts to make it easier for application developers to write secure code, Microsoft has added a new feature, named Request Validation, to the ASP.Net 1.1 framework. This feature is provides out of the box protection again...
JBoss %00 Request JSP Source Disclosure
It is possible to make the remote web server disclose the source code of its JSP pages by appending a NULL character to the name of the JSP files requested eg, 'foo.jsp%00'. An attacker may use this flaw to get the source code of scripts on the remote host and possibly obtain passwords and other...
CVE-2002-1031
CVE-2002-1031 affects KeyFocus (KF) web server 1.0.2. The vulnerability permits remote attackers to list directories and read restricted files through an HTTP request containing a null byte (%00). The NVD analysis indicates network access with low attack complexity and no authentication, resultin...