Microsoft Internet Explorer 6 - Font Tag Denial of Service

source: https://www.securityfocus.com/bid/11536/info Microsoft Internet Explorer is reported prone to a remote denial of service vulnerability. The issue presents itself due to a malfunction that occurs when certain font tags are encountered and rendered. When a page that contains the malicious...

CVE-2004-1614

Mozilla allows remote attackers to cause a denial of service application crash from invalid memory access via an "unusual combination of visual elements," including several large MARQUEE tags with large height parameters, as demonstrated by mangleme...

YaBB 1.x9.1.2000 - Administrator Command Execution

YaBB 1.x9.1.2000 - Administrator Command Execution source: https://www.securityfocus.com/bid/11214/info It is reported that YaBB is affected by an administrator command execution vulnerability. This issue is due to a failure of the application to properly validate access to administrative command...

YaBB 1.x/9.1.2000 - Administrator Command Execution

source: https://www.securityfocus.com/bid/11214/info It is reported that YaBB is affected by an administrator command execution vulnerability. This issue is due to a failure of the application to properly validate access to administrative commands. This issue permits a remote attacker to create a...

CVE-2004-0527

KDE Konqueror 2.1.1 and 2.2.2 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack...

Mandrake Linux Security Advisory : php (MDKSA-2004:068)

"Stefan Esser discovered a remotely exploitable vulnerability in PHP where a remote attacker could trigger a memorylimit request termination in places where an interruption is unsafe. This could be used to execute arbitrary code. As well, Stefan Esser also found a vulnerability in the handling of...

CVE-2004-0595

The striptags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null \0 characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and...

DSA-531 php4 - several vulnerabilities

Bulletin has no description...

security flaw

The striptags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null \0 characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and...

XSS в разных форумах

Здравствуйте, 3APA3A. играясь с е107 обнаружил следующее: forum проверено на версии 6.12 возможность вставки BBCode URL=http://some.url"style="position:absolute;left:220px;top:10px;"size=14test /size/URL проверенный:...

CVE-2004-0595

The striptags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null \0 characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and...

PHP 4.x5.0 - Strip_Tags() Function Bypass

PHP 4.x5.0 - StripTags Function Bypass source: https://www.securityfocus.com/bid/10724/info It is reported that it is possible to bypass PHPs striptags function. It is reported that under certain circumstances, PHPs striptags function will improperly leave malformed tags in place. This...

PHP 4.x/5.0 - 'Strip_Tags()' Function Bypass

source: https://www.securityfocus.com/bid/10724/info It is reported that it is possible to bypass PHPs striptags function. It is reported that under certain circumstances, PHPs striptags function will improperly leave malformed tags in place. This vulnerability may mean that previously...

[Full-Disclosure] RS-2004-2: "Content-Type" XSS vulnerability affecting other webmail systems

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =============================== - RS-Labs Security Advisory - =============================== Tittle: "Content-Type" XSS vulnerability affecting other webmail systems ID: RS-2004-2 Severity: Medium / High - Arbitrary tags injection in victim's browser...

CVE-2004-0527

CVE-2004-0527 affects KDE Konqueror 2.1.1 and 2.2.2. The issue allows remote attackers to spoof a legitimate URL in the status bar by using A HREF tags with modified alt values that point to the legitimate site, combined with an image map whose href points to the malicious site, enabling a phishi...

CVE-2004-0528: Undefined Security Weakness

Netscape Navigator 7.1 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack...

CVE-2004-0470: Undefined Security Weakness

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remov...

Opera Web Browser 7.0 - Remote IFRAME Denial of Service

Opera Web Browser 7.0 - Remote IFRAME Denial of Service source: https://www.securityfocus.com/bid/10081/info A denial of service vulnerability has been reported to affect Opera Web Browser. The issue is reported to present itself when Opera attempts to render IFRAME HTML tags that contain an...

PHP-Nuke 6.x/7.0/7.1 - Image Tag Admin Command Execution

source: https://www.securityfocus.com/bid/9895/info It has been reported that PHP-Nuke is prone to a remote admin command execution vulnerability. This issue is due to a design error that allows an attacker to specify arbitrary URI values in bbCode tags contained within posts. This issue may be...

YaBBXSS.txt

Advisory Name : YaBB/YaBBse Cross Site Scripting Vulnerability Release Date : Mar 14,2004 Application : YaBB/YaBBse Test On : YaBB 1 GoldSP1.3 YaBB SE 1.5.1 Final Vendor URL : http://www.yabbforum.com/ http://www.yabbse.org/ Discover : Cheng Peng Suapplesoupatmsn.com Proof of conecpt: The problem...