Sirefef Malware Found Using Unicode Right-to-Left Override Technique

Old malware tricks never really die, they just get recycled and passed down to the next generation of attackers. The latest technique to get run through the wayback machine is the use of the right-to-left override character in Unicode, a tactic that enables malware authors to hide the real name o...

DEBIAN-CVE-2013-4238

The ssl.matchhostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."...

ruby: hostname check bypassing vulnerability in SSL client

The OpenSSL::SSL.verifycertificateidentity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows...

CVE-2013-1968

Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service FSFS repository corruption via a newline character in a file name...

CVE-2013-1968

Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service FSFS repository corruption via a newline character in a file name...

CVE-2013-1968

Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service FSFS repository corruption via a newline character in a file name...

CVE-2013-1968

Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service FSFS repository corruption via a newline character in a file name...

Google Patches QR Code Vulnerability in Google Glass

A Google Glass feature that gives the device the ability to automatically read text also leaves it vulnerable to malicious wireless networks. The feature is made possible by a technology called optical character recognition. It’s this feature that reportedly allows Google Glass to understand...

Oracle Linux 5 : glibc (ELSA-2013-0769)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0769 advisory. - Fix multibyte character processing crash in regexp CVE-2013-0242, 951130 - Fix getaddrinfo stack overflow resulting in application crash CVE-2013-191...

CVE-2013-3166

CVE-2013-3166 is an XSS vulnerability in Microsoft Internet Explorer (IE6–IE10) that arises from incorrect auto‑selection of the Shift JIS encoding, enabling remote script/HTML execution via cross‑domain scrolling events. The issue is documented as the Shift JIS Character Encoding Vulnerability a...

backspace_between_dots

This evasion plugin inserts an A and a backspace control character between dots which cancel each other when they are processed and some filters that match ../ are bypassed. Example: Input: ../../etc/passwd Output: .%41%08./.%41%08./etc/passwd Plugin type Evasion Options This plugin doesnt have a...

CVE-2013-1968

Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service FSFS repository corruption via a newline character in a file name...

74CMS talent system v3. 2 injection and full version pass rounded out the background is attached using the EXP-bug warning-the black bar safety net

Set of procedures filter is still relatively full, but all versions are GBK encoding is his flawed but basically the string into the library when the author used the iconv to convert the submitted over the data encoding into utf8 So the use of wide-character injection there is no way out but the...

Fedora 17 : glibc-2.15-59.fc17 (2013-4174)

Fix multibyte character processing crash in regexp 922889, 905874, CVE-2013-0242 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

1

kernel 2.6.18-348.6.1.0.1 - oprofile x86, mm: Add getuserpagesfast orabug 14277030 - oprofile export getuserpagesfast function orabug 14277030 - oprofile oprofile, x86: Fix nmi-unsafe callgraph support orabug 14277030 - oprofile oprofile: use KMNMI slot for kmapatomic orabug 14277030 - oprofile...

php character comparison Double equal characteristics may be references made to the security-vulnerability warning-the black bar safety net

Title party!, the The article is relatively short, ha ha! Before learning php, research. php auto similar conversion,this is php a feature, not a 0day,phper know something, There are similar perl. Straight cut body, we learn php know that“==”with”===”the difference,the former in the comparison of...

phpwind 9 /src/service/tag/dao/PwTagDao.php SQL注入漏洞

phpwind是国内一款流行的内容管理系统软件，其9版本/src/service/tag/dao/PwTagDao.php文件代码第116行的$tagName变量由$GET方式获得，代码117-119行拼接SQL语句，带入数据查询。在查询之前执行了/wind/db/mysql/WindMysqlPdoAdapter.php文件代码第24行设置编码为gbk，由此导致宽字节漏洞产生。 phpwind 9...

Gbbs micro Forum v3. 1. 4 injection vulnerability-vulnerability warning-the black bar safety net

Official address: http://www.softatm.com Vulnerability to prove:/css/ss.txt Program download: http://down.chinaz.com/soft/33484.htm Vulnerability files /userinfo. asp 7 2 row 7 row 4 Vulnerability type: character type injection Vulnerability information: p%yhm = request"yhm" set rs=server...

RedHat Update for glibc RHSA-2013:0769-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...