Unfixed XSS vulnerability at www.thecomedystore.co.uk

Security researcher IrIsT.Ir, has submitted on 07/01/2012 a cross-site-scripting XSS vulnerability affecting www.thecomedystore.co.uk, which at the time of submission ranked 347951 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/01/2012. It ...

CVE-2012-2694

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

Race condition

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

CVE-2012-2694

CVE-2012-2694 is a Ruby on Rails Active Record/parameter handling weakness where Rails versions 3.0.x before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 fail to align Active Record and Rack parameter handling, enabling remote attackers to bypass query restrictions and perform NULL checks v...

CVE-2012-2660

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

CVE-2012-2660 rubygem-actionpack: Unsafe query generation

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

tomcat: large number of parameters DoS

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service CPU consumption via a request that contains many parameters and parameter values, a different vulnerability...

FreeBSD Ports: tomcat

The remote host is missing an update to the system as announced in the referenced advisory. VID 7f5ccb1d-439b-11e1-bc16-0023ae8e59f0 OpenVAS Vulnerability Test $ Description: Auto generated from VID 7f5ccb1d-439b-11e1-bc16-0023ae8e59f0 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

tomcat: large number of parameters DoS

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service CPU consumption via a request that contains many parameters and parameter values, a different vulnerability...

tomcat: large number of parameters DoS

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service CPU consumption via a request that contains many parameters and parameter values, a different vulnerability...

FreeBSD : tomcat -- Denial of Service (7f5ccb1d-439b-11e1-bc16-0023ae8e59f0)

The Tomcat security team reports : Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to cause lar...

Apache Tomcat Parameter Handling Denial of Service Vulnerability - Windows

Apache Tomcat Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Tomcat Large Number Denial Of Service

No description provided by source. CVE-2012-0022 Apache Tomcat Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.22 - Tomcat 6.0.0 to 6.0.33 - Tomcat 5.5.0 to 5.5.34 - Earlier, unsupported versions may also be affected Descriptio...

CVE-2012-0022

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service CPU consumption via a request that contains many parameters and parameter values, a different vulnerability...

Fixed in Apache Tomcat 5.5.35

Important: Denial of service CVE-2012-0022 Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to...

Fixed in Apache Tomcat 7.0.23

Important: Denial of service CVE-2012-0022 Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to...

phpcms 2008 product.php pagesize参数代码注射漏洞

PHPCMS是国内领先的网站管理系统，同时也是一个开源的PHP开发框架。 PHPCMS 2008在处理某些模板参数时存在安全漏洞，其yp/product.php页面的pagesize参数没有正确进行检查过滤，导致可以提交任意字符，远程攻击者可利用此漏洞执行任意命令 具体的代码触发路径是这样的： phpcms/yp/product.php中获取pagesize参数，拼接为$urlrule变量。随后将之带入yp目录下的product.html模板之中。在模板执行后，进入到get函数处理中，最后经过get-pages-pageurl函数，最终触发pageurl的如下代码： eval"$url ...

tomcat -- Denial of Service

The Tomcat security team reports: Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to cause larg...

CVE-2011-3140

IBM Web Application Firewall, as used on the G400 IPS-G400-IB-1 and GX4004 IPS-GX4004-IB-2 appliances with update 31.030, does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass intended intrusion prevention by dividing a...

Skype URI参数处理多个安全漏洞

BUGTRAQ ID: 38699 Skype是一款流行的P2P VoIP软件，可提供高质量的语音通讯服务。 Skype在处理URI中的参数串时存在输入验证漏洞，远程攻击者可能利用此漏洞修改用户的配置或访问某些敏感信息。 URI中可能包含的/Datapath参数可以指向恶意的SMB共享，攻击者可以通过诱使用户点击恶意的skype: URI来利用漏洞。 此外Skype在处理skype-plugin:协议时也没有正确的过滤恶意URI参数，用户跟随恶意链接就可能导致删除任意指定的XML文件。 Skype 4.x 厂商补丁： Skype -----...