squirrelmail -- Cross site scripting in HTML filter

The SquirrelMail developers report: Multiple cross-site scripting XSS vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the 1 data: URI in an HTML e-mail attachment or 2 various non-ASCII character sets that a...

PostgreSQL / MySQL extended character sets SQL injections

It's possible to use character different from quote sign in different encodings...

CVE-2006-2753

SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the mysqlrealescape function is...

Sql injection

SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the mysqlrealescape function is...

CVE-2006-2753

SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the mysqlrealescape function is...

CVE-2006-2753

CVE-2006-2753 – MySQL SQL injection via multibyte encodings : Affected products are MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22. The issue arises when multibyte encodings (e.g., SJIS, BIG5, GBK) are processed during input escaping with mysql_real_escape, leading to context-dependent SQL inj...

FreeBSD : bogofilter -- heap corruption through malformed input (92140bc9-7bde-11da-8ec4-0002b3b60e4c)

Matthias Andree reports : When using Unicode databases default in more recent bogofilter installations, upon encountering invalid input sequences, bogofilter or bogolexer could overrun a malloc'd buffer, corrupting the heap, while converting character sets. Bogofilter would usually be processing...

CVE-2006-1189

Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name IDN using double-byte character sets DBCS, aka the "Double Byte Character Parsing Memory Corruption Vulnerability."...

Sql injection

SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets...

CVE-2006-1118

SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets...

CVE-2006-1118

The CVE-2006-1118 entry concerns an SQL injection vulnerability in the mail application bmail prior to Aardvark PR9.1 . The underlying issue is an input/construct flaw that allows remote attackers to execute arbitrary SQL commands via vectors involving the GBK character set. Impact is described a...

[SA19147] bMail GBK Charsets SQL Injection Vulnerability

TITLE: bMail GBK Charsets SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19147 VERIFY ADVISORY: http://secunia.com/advisories/19147/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: bMail 9.x http://secunia.com/product/8584/ DESCRIPTION: A vulnerability...

Code injection

POPFile before 0.22.4 allows remote attackers to cause a denial of service application crash via unspecified vectors involving character sets within e-mail messages...

CVE-2006-0876

POPFile before 0.22.4 allows remote attackers to cause a denial of service application crash via unspecified vectors involving character sets within e-mail messages...

CVE-2006-0876

POPFile before 0.22.4 allows remote attackers to cause a denial of service application crash via unspecified vectors involving character sets within e-mail messages...

CVE-2006-0876

POPFile before 0.22.4 allows remote attackers to cause a denial of service application crash via unspecified vectors involving character sets within e-mail messages...

CVE-2006-0876

POPFile (a Bayesian mail classifier) is affected by CVE-2006-0876: versions before 0.22.4 can be forced to crash (denial of service) via unspecified vectors involving character sets in email messages. The Debian advisory notes fixes in 0.22.2-2sarge1 (stable update) and 0.22.4-1 (unstable), and r...

bogofilter SPAM filter buffer overflows

Buffer overflows on oversized words and on character sets conversion...

CVE-2005-4591

Heap-based buffer overflow in bogofilter 0.96.2, 0.95.2, 0.94.14, 0.94.12, and other versions from 0.93.5 to 0.96.2, when using Unicode databases, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via "invalid input sequences" that lead to heap...

Symantec Brightmail Anti-Spam Spamhunter UTF encoding error

Overview Symantec Brightmail Anti-Spam Spamhunter crashes when trying to convert certain valid character sets to UTF, resulting in a denial-of-service condition. Description Brightmail Anti-Spam Spamhunter is a spam filter designed for corporate environments. The Brightmail Anti-Spam Spamhunter...