CVE-2008-3429

Buffer overflow in URI processing in HTTrack and WinHTTrack before 3.42-3 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long URL...

Sql injection

SQL injection vulnerability in Comsenz EPShop aka ECShop before 3.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a 1 proshow or 2 disppro action to the default URI...

HTTrack URI解析远程缓冲区溢出漏洞

BUGTRAQ ID: 30425 CNCAN ID：CNCAN-2008073103 HTTrack一款免费并易于使用的线下浏览器工具。 HTTrack处理URI存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 构建超长的URI，诱使HTTrack处理可触发此漏洞，精心构建提交数据可能以应用程序权限执行任意指令。 HTTrack WinHTTrack 3.42-2 HTTrack WinHTTrack 3.42 HTTrack HTTrack 3.42-2 HTTrack HTTrack 3.42 可联系供应商获得补丁信息： http://www.httrack.co...

Cross site scripting

Cross-site scripting XSS vulnerability in Snark VisualPic 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the pic parameter to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Apache Tomcat JK Web Server Connector URI worker map buffer overflow

Added: 07/30/2008 CVE: CVE-2007-0774 BID: 22791 OSVDB: 33855 Background Apache Tomcat is a Java web application platform which can run under various types of web servers. The JK Web Server Connector modjk is used for communication between Tomcat and the web server. Problem A buffer overflow in a...

SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5450)

MozillaFirefox was updated to version 2.0.0.16, which fixes various bugs and following security issues : - An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla CSS reference counting code. The vulnerability was caused by an insufficiently...

Ubuntu 8.04 LTS : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-626-1)

A flaw was discovered in the browser engine. A variable could be made to overflow causing the browser to crash. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the...

USN-626-1: Firefox and xulrunner vulnerabilities

A flaw was discovered in the browser engine. A variable could be made to overflow causing the browser to crash. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BilboBlog 0.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 content parameter to admin/update.php, related to conflicting code in widget.php; and allow remote attackers to inject arbitrary web scri...

WordPress Plugin Download Manager 0.2 - Arbitrary File Upload

WordPress Plugin Download Manager 0.2 - Arbitrary File Upload WORDPRESS PLUGIN DOWNLOAD MANAGER 0.2 REMOTE FILE UPLOAD SaO BiyoSecurityTeam || www.biyosecurity.com Plugin URI: http://giulioganci.netsons.org/downloads-manager Local File milw0rm.com 2008-07-24...

Design/Logic Flaw

rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2, as used by repro, allows remote attackers to cause a denial of service daemon crash via a SIP 1 INVITE or 2 OPTIONS message with a long domain name in a request URI, which triggers an assert error...

Mozilla Foundation Security Advisory 2008-35

Mozilla Foundation Security Advisory 2008-35 Title: Command-line URLs launch multiple tabs when Firefox not running Impact: Critical Announced: July 15, 2008 Reporter: Billy Rios, Ben Turner, Dan Veditz Products: Firefox Fixed in: Firefox 3.0.1 Firefox 2.0.0.16 Description Security researcher Bil...

Ubuntu 6.06 LTS / 7.04 / 7.10 : firefox vulnerabilities (USN-623-1)

A flaw was discovered in the browser engine. A variable could be made to overflow causing the browser to crash. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the...

CreaCMS - edition_articleedition_article.php?cfg[document_uri] Remote File Inclusion

CreaCMS - editionarticleeditionarticle.php?cfgdocumenturi Remote File Inclusion source: https://www.securityfocus.com/bid/30284/info CreaCMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an...

USN-623-1: Firefox vulnerabilities

A flaw was discovered in the browser engine. A variable could be made to overflow causing the browser to crash. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the...

CVE-2008-2933

Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' pipe characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely...

Design/Logic Flaw

Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' pipe characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely...

CVE-2008-2933

Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' pipe characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely...

CVE-2008-2933

CVE-2008-2933 describes a pipe character in a URL that can trigger Chrome privilege escalation in Iceape/Iceweasel Firefox-family products. Connected advisories confirm active fixes: Iceweasel/iceape upgrades to 2.0.0.16 (etch) and later 3.0.1–1 (sid) or equivalent patched builds; Iceweasel 2.0.0...

CVE-2008-2933

Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' pipe characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely...