mod_jk: Buffer overflow when concatenating virtual host name and URI

It was found that the length checks prior to writing to the target buffer for creating a virtual host mapping rule did not take account of the length of the virtual host name, creating the potential for a buffer overflow...

Mozilla Firefox Local File Access Vulnerability

Mozilla Firefox is an open source web browser; Mozilla Firefox fails to properly restrict drag-and-drop operations on file: URIs, allowing remote attackers to exploit the vulnerability to build malicious WEB pages that can be tricked into parsing to access local files...

Apache XML-RPC Server-Side Request Forgery Vulnerability

Apache XML-RPC is the United States Apache Apache Software Foundation of a simple, lightweight set of RPC communication through the HTTP protocol specification. A server-side request forgery vulnerability exists in Apache XML-RPC that allows a remote attacker to construct a malicious URI, trick a...

The vulnerability of the Firefox browser, which allows a hacker to replace web pages

The vulnerability of Firefox browsers is related to errors in processing the "" character in URI data. Exploiting this vulnerability can allow a remote attacker to replace web pages...

SolarWinds DameWare Mini Remote Control Stack Buffer Overflow Vulnerability

SolarWinds DameWare Mini Remote Control is a suite of remote control software for laptops and servers that provides remote desktop access and screen sharing capabilities. A stack buffer overflow vulnerability exists in the URI handler in the DWRCC.exe file in versions prior to SolarWinds DameWare...

Android elevation of privilege vulnerability (CNVD-2015-06528)

Android is an operating system based on the Linux open kernel, announced on November 5, 2007 by Google Inc. for cell phones. An elevation of privilege vulnerability exists in LMY48I, a version of Android prior to 5.1.1, which allows an attacker to gain privileges to a URI via an application that...

Apple Safari PDF Arbitrary Script Execution Vulnerability

Apple Safari is a popular WEB browser. A security vulnerability exists in Apple Safari that allows an attacker to construct a malicious URI containing an embedded PDF page, which induces a user to visit it and execute arbitrary script code in the context of the target user...

PHP 'do_soap_call' Sensitive Information Disclosure Vulnerability

PHP is a general-purpose programming language. The 'dosoapcall' function in PHP's ext/soap/soap.c file does not verify that the uri attribute is a string, allowing remote attackers to provide serialized data with the int data type to obtain sensitive information...

IBM WebSphere Cross-Site Request Forgery Vulnerability

IBM WebSphere Portal provides a framework for combining application or business mashups and provides a high-level tool to construct flexible, SOA-based solutions. A cross-site request forgery vulnerability exists in IBM WebSphere Portal that allows a remote attacker to construct a malicious URI,...

Drupal Finder Module Open Redirect Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Finder is one of the search modules. An open redirection vulnerability exists in the Drupal Finder module, which stems from the program's failure to adequately filter user-submitted...

UBUNTU-CVE-2014-4927

Buffer overflow in ACME microhttpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service crash via a long string in the URI in a GET request...

DEBIAN-CVE-2014-2538

Cross-site scripting XSS vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack...

UBUNTU-CVE-2013-7039

Stack-based buffer overflow in the MHDdigestauthcheck function in libmicrohttpd before 0.9.32, when MHDOPTIONCONNECTIONMEMORYLIMIT is set to a large value, allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long URI in an authentication header...

DEBIAN-CVE-2013-4547

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI...

Oracle JavaServer Faces Multiple Partial Directory Traversals

The remote web server contains a JavaServer Faces application that is affected by multiple partial directory traversal vulnerabilities : - A defect exists in the handling of a resource identifier that allows for directory traversal within the application. - A defect exists in the handling of a...

PT-2013-1073

Name of the Vulnerable Software and Affected Versions Varnish versions prior to 3.0.5 Description The issue allows remote attackers to cause a denial of service, leading to a child-process crash and temporary caching outage. This can be achieved via a GET request with trailing whitespace characte...

Oracle GlassFish Server 2.1.13.0.1 - Multiple Subcomponent Resource Identifier Traversal Arbitrary File Access

Oracle GlassFish Server 2.1.13.0.1 - Multiple Subcomponent Resource Identifier Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/63052/info Oracle JavaServer Faces is prone to multiple directory-traversal vulnerabilities. Exploiting these issues may allow an attacker to...

Oracle GlassFish Server 2.1.1/3.0.1 - Multiple Subcomponent Resource Identifier Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/63052/info Oracle JavaServer Faces is prone to multiple directory-traversal vulnerabilities. Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks. This vulnerability affects the following products...

DEBIAN-CVE-2011-3368

The modproxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to...

mod_dav: DoS (httpd child process crash) by parsing URI structure with missing path segments

The 1 modcache and 2 moddav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service process crash via a request that lacks a path...