CVE-2010-0642

Cisco Collaboration Server CCS 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by 1 changing .jhtml to %2Ejhtml, 2 changing .jhtml to .jhtm%6C, 3 appending %00 after .jhtml, and 4 appending %c0%80 after .jhtml,...

Design/Logic Flaw

Cisco Collaboration Server CCS 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by 1 changing .jhtml to %2Ejhtml, 2 changing .jhtml to .jhtm%6C, 3 appending %00 after .jhtml, and 4 appending %c0%80 after .jhtml,...

CVE-2010-0642

Cisco Collaboration Server CCS 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by 1 changing .jhtml to %2Ejhtml, 2 changing .jhtml to .jhtm%6C, 3 appending %00 after .jhtml, and 4 appending %c0%80 after .jhtml,...

CVE-2010-0642

Cisco Collaboration Server 5 is affected by CVE-2010-0642, a source-code disclosure vulnerability that lets remote attackers read JHTML files by crafting URL-encoded filename extensions (e.g., .jhtml → %2Ejhtml, .jhtml → .jhtm%6C, etc.). The affected components include multiple CCS web interfaces...

GoAhead WebServer URL Encoded Slash Directory Traversal Vulnerability

Exploit for unknown platform in category web applications ===================================================================== GoAhead WebServer URL Encoded Slash Directory Traversal Vulnerability ===================================================================== simply go to http://ipaddress...

Trendnet TV-IP201 Directory Traversal / Authentication Bypass

simply go to http://ipaddress of camera/..%5C..%5C..%5C..%5C..%5C..%5C/config/tcfgsystem.asp system administration page These cams use an embedded version of GoAhead WebServer which is vulnerable to the above attack because they don't correctly filter URL encoded substitutions for the '/'...

CVE-2008-4788

Microsoft Internet Explorer 6 omits high-bit URL-encoded characters when displaying the address bar, which allows remote attackers to spoof the address bar via a URL with a domain name that differs from an important domain name only in these characters, as demonstrated by using exam%A9ple.com to...

Code injection

Konqueror in KDE 3.5.9 allows remote attackers to cause a denial of service application crash via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters...

CVE-2008-4382

Konqueror in KDE 3.5.9 allows remote attackers to cause a denial of service application crash via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters...

CVE-2008-4382

Konqueror in KDE 3.5.9 allows remote attackers to cause a denial of service application crash via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters...

CVE-2008-4381

The CVE-2008-4381 entry describes a vulnerability in Microsoft Internet Explorer 7 where remote attackers can cause an application crash (DoS) by running Javascript that calls alert with a URL-encoded string containing a large number of invalid characters. The core issue is a DoS condition trigge...

CVE-2008-4381

Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service application crash via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters...

Mozilla Foundation Security Advisory 2008-44

Mozilla Foundation Security Advisory 2008-44 Title: resource: traversal vulnerabilities Impact: Moderate Announced: September 23, 2008 Reporter: Boris Zbarsky, Georgi Guninski Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.0.2 Firefox 2.0.0.17 Thunderbird 2.0.0.17 SeaMonkey 1.1.12...

CVE-2008-4067

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. dot dot and URL-encoded / slash characters in a resource: URI...

Directory traversal

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. dot dot and URL-encoded / slash characters in a resource: URI...

resource: traversal vulnerabilities — Mozilla

Mozilla developer Boris Zbarsky reported that the resource: protocol allowed directory traversal on Linux when using URL-encoded slashes...

django -- XSS vulnerability

Django project reports: The Django administration application will, when accessed by a user who is not sufficiently authenticated, display a login form and ask the user to provide the necessary credentials before displaying the requested page. This form will be submitted to the URL the user...

Cross site scripting

Cross-site scripting XSS vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258, and other versions before 5.3.3.378, allows remote attackers to inject arbitrary web script or HTML via a URL-encoded postdata parameter. NOTE: this is different than CVE-2005-1118, but it mig...

CVE-2008-2026

Cross-site scripting XSS vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258, and other versions before 5.3.3.378, allows remote attackers to inject arbitrary web script or HTML via a URL-encoded postdata parameter. NOTE: this is different than CVE-2005-1118, but it mig...

Crlf injection

CRLF injection vulnerability in Microsoft Internet Explorer 5 and 6 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded CRLF %0D%0A before the FTP command, which causes the commands to be inserted into an authenticated FTP connection established...