1252 matches found
CVE-2003-1312
siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which might allow remote attackers to obtain the ID by sniffing, reading Referer logs, or other methods...
Buffer overflow in SimpleWebServer
Buffer overflow on oversized URL and Referer header...
CVE-2003-0762
Buffer overflow in 1 foxweb.dll and 2 foxweb.exe of Foxweb 2.5 allows remote attackers to execute arbitrary code via a long URL PATHINFO value...
Lotus Domino /./ Request Database Locking DoS
It might be possible to lock out some Lotus Domino databases by requesting them through the web interface with a special request containing a '/./' string in the URL path. This attack is only efficient on databases that are not used by the server. Note that no real attack was performed, so this m...
Lotus Domino Source code disclosue
Additional dot in URL allows page source code access...
'Malicious-URL' Feature may be Circumvented Using IP Fragmentation
Title: NetScreen Security Alert 51929 Date: 25 November 2002 Impact: 'Malicious-URL' Feature may be Circumvented Using IP Fragmentation Affected Products: All firewall/VPN appliances and systems Affected Software Releases: ScreenOS 2.7.1, 2.8, 3.0, 3.1, 4.0 Max Risk: Low Summary: In response to t...
Long URL causes TelCondex SimpleWebServer to crash
Hi! I've found a vulnerability in TelCondex SimpleWebServer 2.06.20817 Build 3128 tested on Windows XP Professional. It could be that prior versions are also affected. It's possible to crash the web server application with a long URL starting from 539 Chars1. You'll see a popup message on the...
Important: Red Hat Security Advisory: : Updated gaim client fixes URL vulnerability
Updated gaim packages are now available for Red Hat Powertools 7. These updates fix a vulnerability in the URL handler. Gaim is an all-in-one instant messaging client that lets you use a number of messaging protocols such as AIM, ICQ, and Yahoo, all at once. Versions of gaim prior to 0.59.1 conta...
Important: Red Hat Security Advisory: : Updated gaim client fixes URL vulnerability
Updated gaim packages are now available for Red Hat Linux 7.1, 7.2, and 7.3. These updates fix a vulnerability in the URL handler. Gaim is an all-in-one instant messaging client that lets you use a number of messaging protocols such as AIM, ICQ, and Yahoo, all at once. Versions of gaim prior to...
Cross-Site Scripting in Aestiva's HTML/OS
"Aestiva HTML/OS is a high-performance database engine and development suite for building advanced web sites and web-based software products." SUMMARY: The Aestiva HTML/OS CGIs appear vulnerable to XSS due to poor error reporting no metacharacter filtering. Anything you want can be appended to an...
CVE-2002-0665
Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash / in the URL...
Snitz Forums 2000 vulnerable to cross-site scripting via crafted IMG tag
Overview Snitz Forums 2000 does not adequately check "IMG" tag "SRC" attributes and thus contains cross-site scripting vulnerability. Description Snitz Forums is an automated bulletin-board program for web sites. Snitz Forums allows users to submit images by specifying the URL of the image. In...
Microsoft Internet Explorer 56 - FTP Web View Cross-Site Scripting
Microsoft Internet Explorer 56 - FTP Web View Cross-Site Scripting source: https://www.securityfocus.com/bid/4954/info A cross site scripting issue has been reported with some versions of Microsoft Internet Explorer for Windows. Under some configurations, data included within a FTP URL will be...
Lotus Domino url bypass
--------------------------------------------------------------------------- Web: http://qb0x.net Author: Gabriel A. Maggiotti Date: Febrary 03, 2002 E-mail: [email protected] --------------------------------------------------------------------------- General Info ------------ Problem Type :...
Microsoft IE cookies readable via about: URLS
Microsoft Internet Explorer has a vulnerability which allows a malicious website to access any cookie in the browser's memory or those stored on disk. Cookies are used by web sites for storing preferences, statistics and tracking users, but also for storing more sensitive information such as...
CVE-2001-0274
kicq IRC client 1.0.0, and possibly later versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...
Security Bulletin MS01-014
The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an unattended mailbox. -----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Malform...
CVE-2000-1133
Authentix Authentix100 allows remote attackers to bypass authentication by inserting a . dot into the URL for a protected directory...
CVE-2000-0858
Vulnerability in Microsoft Windows NT 4.0 allows remote attackers to cause a denial of service in IIS by sending it a series of malformed requests which cause INETINFO.EXE to fail, aka the "Invalid URL" vulnerability...