CVE-2002-1126: Undefined Security Weakness

Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs, using the onunloa...

PHP-Nuke MS-Analysis Module - HTTP Referrer Field SQL Injection

source: https://www.securityfocus.com/bid/9948/info Reportedly the MS-Analysis module is prone to a remote SQL injection vulnerability. This issue is due to a failure to properly sanitize user supplied HTTP header input before using it in an SQL query. As a result of this, a malicious user may...

CVE-2003-0405

Vignette StoryServer 5 and Vignette V/6 allows remote attackers to execute arbitrary TCL code via 1 an HTTP query or cookie which is processed in the NEEDS command, or 2 an HTTP Referrer that is processed in the VALIDPATHS command...

CVE-2003-0405: Undefined Security Weakness

Vignette StoryServer 5 and Vignette V/6 allows remote attackers to execute arbitrary TCL code via 1 an HTTP query or cookie which is processed in the NEEDS command, or 2 an HTTP Referrer that is processed in the VALIDPATHS command...

Opera: What's Next (GM#005-OP)

GreyMagic Security Advisory GM005-OP ===================================== By GreyMagic Software, Israel. 04 Feb 2003. Available in HTML format at http://security.greymagic.com/adv/gm005-op/. Topic: Opera: What's Next. Discovery date: 28 Jan 2003. Affected applications: ====================== Ope...

CVE-2002-1647

The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL...

CVE-2002-1126

Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs, using the onunloa...

CVE-2002-0944

Cross-site scripting vulnerability in DeepMetrix LiveStats 5.03–6.2.1 allows remote attackers to execute arbitrary script as the LiveStats user via the (1) user-agent or (2) referrer, which are not filtered by the stats program. Affected: DeepMetrix LiveStats versions 5.03 through 6.2.1. Impact: ...

CVE-2002-0944: Undefined Security Weakness

Cross-site scripting vulnerability in DeepMetrix LiveStats 5.03 through 6.2.1 allows remote attackers to execute arbitrary script as the LiveStats user via the 1 user-agent or 2 referrer, which are not filtered by the stats program...

CVE-2001-1286: Undefined Security Weakness

Ipswitch IMail 7.04 and earlier stores a user's session ID in a URL, which could allow remote attackers to hijack sessions by obtaining the URL, e.g. via an HTML email that causes the Referrer to be sent to a URL under the attacker's control...

CVE-2001-0835

Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attackers to inject arbitrary HTML tags by specifying them in 1 search keywords embedded in HTTP referrer information, or 2 host names that are retrieved via a reverse DNS lookup...

CVE-2001-0835

Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attackers to inject arbitrary HTML tags by specifying them in 1 search keywords embedded in HTTP referrer information, or 2 host names that are retrieved via a reverse DNS lookup...

CVE-2001-0835: Undefined Security Weakness

Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attackers to inject arbitrary HTML tags by specifying them in 1 search keywords embedded in HTTP referrer information, or 2 host names that are retrieved via a reverse DNS lookup...

CVE-2001-0460: Undefined Security Weakness

Websweeper 4.0 does not limit the length of certain HTTP headers, which allows remote attackers to cause a denial of service memory exhaustion via an extremely large HTTP Referrer: header...

CVE-2000-0623: Undefined Security Weakness

Buffer overflow in O'Reilly WebSite Professional web server 2.4 and earlier allows remote attackers to execute arbitrary commands via a long GET request or Referrer header...

valueclick-cgi.txt

Date: Sat, 19 Dec 1998 17:19:34 +0200 From: Philip Stoev Reply-To: Bugtraq List To: [email protected] Subject: ValueClick CGI Vulnerability The following text is in the "KOI8-R" character set. Your display is set for the "US-ASCII" character set. Some characters may be displayed incorrectly. T...