CVE-2006-5231: Undefined Security Weakness

Grandstream GXP-2000 VoIP Desktop Phone, firmware version 1.1.0.5, allows remote attackers to cause a denial of service hang or reboot via a large amount of ASCII data sent to port 1 5060/UDP, 2 5062/UDP, 3 5064/UDP, 4 5066/UDP, 5 9876/UDP, or 6 26789/UDP...

FreeBSD : postgresql -- encoding based SQL injection (17f53c1d-2ae9-11db-a6e2-000e0c2e438a)

The PostgreSQL development team reports : An attacker able to submit crafted strings to an application that will embed those strings in SQL commands can use invalidly-encoded multibyte characters to bypass standard string-escaping methods, resulting in possible injection of hostile SQL commands...

CVE-2006-3298

Yahoo! Messenger 7.5.0.814 and 7.0.438 allows remote attackers to cause a denial of service crash via messages that contain non-ASCII characters, which triggers the crash in jscript.dll...

CVE-2006-3298

Yahoo! Messenger 7.5.0.814 and 7.0.438 allows remote attackers to cause a denial of service crash via messages that contain non-ASCII characters, which triggers the crash in jscript.dll...

CVE-2006-3298: Undefined Security Weakness

Yahoo! Messenger 7.5.0.814 and 7.0.438 allows remote attackers to cause a denial of service crash via messages that contain non-ASCII characters, which triggers the crash in jscript.dll...

MailEnable DoS

SMTP HELO command with non-ASCII character causes service to crash...

CVE-2006-3227

Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, whi...

CVE-2006-3227

CVE-2006-3227 describes an interpretation conflict between Internet Explorer and other browsers (e.g., Mozilla/Firefox/Opera) that may let remote attackers alter the visual presentation of web pages and potentially bypass protection mechanisms by using ASCII characters with the 8th bit set. IE ma...

CVE-2006-3227

Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, whi...

CVE-2006-3227: Undefined Security Weakness

Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, whi...

Yahoo! Messenger <= 7.5.0.184 Multiple Vulnerabilities

Binary data 3665.prm...

Re: Bypassing of web filters by using ASCII

Jeremiah Grossman and I were able to get a proof of concept working based off of Kurt's work that actually runs a simple piece of JavaScript in IE, without using open or close angle brackets. Here's the link to the post: http://ha.ckers.org/blog/20060621/us-ascii-xss-part-2/ I concur that it woul...

Microsoft Internet Explorer filtering protection bypass

For ASCII codepage 8-bit text is converted to 7-bit. It makes it possible to bypass content filters with 8-bit characters within ASCII encoded text...

Bypassing of web filters by using ASCII

iKu Advisory Product : Microsoft InternetExplorer 6 : various filter applications Date : June 20th 2006 Affected versions : all Vulnerability Type : bypassing security filters Severity 1-10 : 10 Remote : yes 0. contents 1. problem description 2. affected software 3. bug description/possible fix 4...

DataLife Engine 4.1 - SQL Injection

!/usr/bin/perl DataLife Engine sql injection exploit by RST/GHC coded by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru 18.06.06 use LWP::UserAgent; use Getopt::Std; getopts'u:n:p:'; $url = $optu; $name = $optn; $prefix = $optp || 'dle'; if!$url || !$name $snum = 1; $|++; $n = 0; print "\r\n";...

USN-303-1: MySQL vulnerability

An SQL injection vulnerability has been discovered when using less popular multibyte encodings such as SJIS, or BIG5 which contain valid multibyte characters that end with the byte 0x5c the representation of the backslash character ''''''...

0verkill 0.16 - ASCII-ART Game Remote Integer Overflow Crash (PoC)

0verkill 0.16 - ASCII-ART Game Remote Integer Overflow Crash PoC !/usr/bin/env python ----------------------------------------------------- Exploit id: FSE:016 Author: Federico Fazzi Contact: [email protected] Date: 09/06/2006, 13:58 Sinthesis: 0verkill 0.16, Remote integer overflow Product:...

Vulnerability in core server (CVE-2006-2314)

The widely-used practice of escaping ASCII single quote "'" by turning it into "'" is unsafe when operating in multibyte encodings that allow 0x5c ASCII code for backslash as the trailing byte of a multibyte character...

postgresql -- encoding based SQL injection

The PostgreSQL development team reports: An attacker able to submit crafted strings to an application that will embed those strings in SQL commands can use invalidly-encoded multibyte characters to bypass standard string-escaping methods, resulting in possible injection of hostile SQL commands in...

IDS evasion techniques and countermeasures detailed description-vulnerability warning-the black bar safety net

In the network thriving for a few days, the network security issues become increasingly prominent. Network on the Black, White two in the network security of the various fields are engaged in a fierce competition. The black hat community and constantly launch Dodge or across the networkintrusion...