Design/Logic Flaw

Visual truncation vulnerability in Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar via a URL with a hostname containing many Non-Blocking Space character sequences, which are rendered as whitespace, aka MSRC ticket MSRC7899, a related issue to CVE-2003-1025...

CVE-2008-4787

Visual truncation vulnerability in Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar via a URL with a hostname containing many Non-Blocking Space character sequences, which are rendered as whitespace, aka MSRC ticket MSRC7899, a related issue to CVE-2003-1025...

Microsoft Internet Explorer 6 - NBSP; Address Bar URI Spoofing

Microsoft Internet Explorer 6 - NBSP; Address Bar URI Spoofing source: https://www.securityfocus.com/bid/31960/info Internet Explorer is affected by a URI-spoofing vulnerability because it fails to adequately handle specific combinations of the non-breaking space character ''. An attacker may...

Windows Server Service buffer overflow MS08-067

Added: 10/24/2008 CVE: CVE-2008-4250 BID: 31874 OSVDB: 49243 Background The Windows Server service supports file, print, and named-pipe sharing over the network. Problem A buffer overflow vulnerability allows remote attackers to execute arbitrary commands by sending a specially crafted RPC reques...

Baidu space XSIO vulnerability-vulnerability warning-the black bar safety net

Article author: aullik5 Original source: http://hi.baidu.com/aullik5/blog ... a02c6785352416.html Today want to talk about this vulnerability is a very wretched vulnerability. Most of the sites have this vulnerability, not only is Baidu. What is XSIO, and why is it wretched? XSIO is because there...

CVE-2008-4106

WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the userlogin column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user's...

MS Windows WRITE_ANDX SMB command handling Kernel DoS (meta)

Exploit for unknown platform in category dos / poc ============================================================ MS Windows WRITEANDX SMB command handling Kernel DoS meta ============================================================ require 'msf/core' module Msf module Exploits module Test class...

Bypass Kaspersky Proactive Defense system of the method of discussion-vulnerability warning-the black bar safety net

==Ph4nt0m Security Team== Issue 0x02, Phile 0x08 of 0x0A |=---------------------------------------------------------------------------=| |=-----------------= Bypass Kaspersky Proactive Defense system method discussions=----------------=|...

USN-637-1: Linux kernel vulnerabilities

It was discovered that there were multiple NULL-pointer function dereferences in the Linux kernel terminal handling code. A local attacker could exploit this to execute arbitrary code as root, or crash the system, leading to a denial of service. CVE-2008-2812 The dochangetype routine did not...

Discuz space. php injection vulnerability analysis-vulnerability warning-the black bar safety net

$member = $db-fetchfirst"SELECT m., mf., u. grouptitle, u. type, u. creditshigher, u. creditslower, u. readaccess, u. color AS groupcolor, u. stars AS groupstars, u. allownickname, u. allowuseblog, r. ranktitle, r. color AS rankcolor, r. stars AS rankstars $oltimeadd1 FROM $tablepremembers m LEFT...

On Tumblr hung it to the principle-vulnerability warning-the black bar safety net

Today I come to tell you to talk about it on the QQ space hung it works, I tried it, the success rate account for 8 0 percent. There are a lot of people have asked me what can be done in broiler flocks, I think for a long time, but the QQ space to hang horse can achieve this. So I try to do it,...

Brk vulnerability analysis and remediation-vulnerability and early warning-the black bar safety net

| brk vulnerability analysis A little out of date music at: I hope everyone also can be a little. --- Brk vulnerability analysis by icbm@0x557 1. brk loopholes in the background 2. The vulnerability principle analysis 3. Exploit analysis 4. The vulnerability is caused by thinking Brk vulnerabilit...

Apple iPhone和iPod Touch 2.0版修复多个安全漏洞

BUGTRAQ ID: 30186 CVECAN ID: CVE-2008-1588,CVE-2008-1589,CVE-2008-2303,CVE-2008-2317,CVE-2008-1590 iPod touch（也被称为iTouch）是苹果公司发布的MP4播放器，iPhone是其发布的智能手机。 iPhone和iPod Touch都内嵌了Safari浏览器，远程攻击者可以利用该浏览器中的多个安全漏洞导致拒绝服务、读取敏感信息或执行任意代码。 CVE-2008-1588...

百度空间XSIO漏洞

XSIO是因为没有限制图片的position属性为absolute，导致可以控制一张图片出现在网页的任意位置。 那么我们就可以用这张图片去覆盖网页上的任意一个位置，包括网站的banner，包括一个link、一个button。 这就可以导致页面破坏。而给图片设置一个链接后，很显然就可以起到一个钓鱼的作用。 由于对正常的HTML 标签百度空间是没有做过滤的，所以我们可以用这些标签来实施XSIO攻击。 在百度，发blog是在一个table里，所以我们要先把table闭合掉，然后再插入合适的图片。 百度空间/07-14 暂无 hi.baidu.com /tablea...

Microsoft Malware Protection Engine TWO DoS Vulnerabilities

CVE-2008-1437 CVE-2008-1438 There are two vulnerabilities idenitified in Microsoft Antivirus product. These vulnerabilities can be exploited to cause Denial of service. 1. CVE-2008-1437 PE Parsing Memory Corruption While scanning a specially crafted PE file, Malware orotection engine...

Multiple DNS implementations vulnerable to cache poisoning

Overview Deficiencies in the DNS protocol and common DNS implementations facilitate DNS cache poisoning attacks. Description The Domain Name System DNS is responsible for translating host names to IP addresses and vice versa and is critical for the normal operation of internet-connected systems...

DSA-1595-1 xorg-server - several vulnerabilities

Bulletin has no description...

Brk vulnerability analysis and remediation-vulnerability and early warning-the black bar safety net

Brk vulnerability analysis and patching brk vulnerability analysis A little out of date music at: I hope everyone also can be a little. Brk vulnerability analysis by icbm@0x557 1. brk loopholes in the background 2. The vulnerability principle analysis 3. Exploit analysis 4. The vulnerability is...

DEBIAN-CVE-2008-1423

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow...

vorbis: integer oveflow caused by huge codebooks

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow...