4617 matches found
CVE-2001-1497
Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanumeric and non-alphanumeric characters used in a password by pressing certain control keys that jump between non-alphanumeric characters, which makes it easier to conduct a brute-force password...
[SECURITY] [DSA-088-1] improper character escaping in fml
Package : fml Problem type : improper character escaping Debian-specific: no The fml a mailing list package as distributed in Debian GNU/Linux 2.2 suffers from a cross-site scripting problem. When generating index pages for list archives the and characters were not properly escaped for subjects...
[SECURITY] [DSA-088-1] improper character escaping in fml
-----BEGIN PGP SIGNED MESSAGE----- - ------------------------------------------------------------------------ Debian Security Advisory DSA-088-1 [email protected] http://www.debian.org/security/ Wichert Akkerman December 5, 2001 -...
Очередные ошибки в CGI
Некомментируется символ перевода строки при вызове внешней команды...
New getAccess[tm] Vulnerability
Good Morning Listmembers, this is another postingsee 1st here http://www.securityfocus.com/bid/3109 about Entrust s "getAccesstm" product Problem Description: "getAccesstm" still uses default shellscripts which start java-classes for their web-applications. due to missing input-validation it is...
CVE-1999-1357
Netscape Communicator 4.04 through 4.7 and possibly other versions in various UNIX operating systems converts the 0x8b character to a "" sign, which could allow remote attackers to attack other clients via cross-site scripting CSS in CGI programs that do not filter these characters...
CVE-1999-1265: Undefined Security Weakness
SMTP server in SLmail 3.1 and earlier allows remote attackers to cause a denial of service via malformed commands whose arguments begin with a "" parenthesis character, such as 1 SEND, 2 VRFY, 3 EXPN, 4 MAIL FROM, 5 RCPT TO...
CVE-2001-0523: Undefined Security Weakness
eEye SecureIIS versions 1.0.3 and earlier allows a remote attacker to bypass filtering of requests made to SecureIIS by escaping HTML characters within the request, which could allow a remote attacker to use restricted variables and perform directory traversal attacks on vulnerable programs that...
Softek MailMarshal 4 / Trend Micro ScanMail 1.0 - SMTP Attachment Protection Bypass
source: https://www.securityfocus.com/bid/3097/info At least two SMTP gateway products have been identified which contain flaws in the handling of restricted filetypes as attachments. An attacker can insert extraneous characters in the filename extension of a hostile attachment. The affected...
CVE-2001-1269
Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/' slash character...
CVE-2001-0392
Navision Financials Server 2.60 and earlier allows remote attackers to cause a denial of service by sending a null character and a long string to the server port 2407, which causes the server to crash...
directorypro.cgi , directory traversal
cgi-script directorypro.cgi is vulnerable to a directory traversal. http://target/cgi-bin/directorypro.cgi?want=showcat&show=../../../..//etc/motd00 I didn't looked at the source of the script but it is probably a script wat normally puts an extension to the requested file. But bij putting the 00...
CVE-2001-0392: Undefined Security Weakness
Navision Financials Server 2.60 and earlier allows remote attackers to cause a denial of service by sending a null character and a long string to the server port 2407, which causes the server to crash...
Дырка в Spy Anywhere (unprotected admin access)
Используя парль из одного символа можно подключиться с привилегиями администратора...
Проблема в The Bat! (<CR> handling)
Некорректная обработка символов 0x0D CR не закрытых символами 0x0A LF ввода POP3-сервера приводит к тому, что часть письма воспринимается как ответ сервера, что приводит к невозможности получения последующих писем с сервера...
CVE-2001-0320: Undefined Security Weakness
bbsmilies.php and bbcoderef.php in PHP-Nuke 4.4 allows remote attackers to read arbitrary files and gain PHP administrator privileges by inserting a null character and .. dot dot sequences into a malformed username argument...
CVE-2001-0201
The Postaci frontend for PostgreSQL does not properly filter characters such as semicolons, which could allow remote attackers to execute arbitrary SQL queries via the deletecontact.php program...
CVE-2001-0201
The Postaci frontend for PostgreSQL does not properly filter characters such as semicolons, which could allow remote attackers to execute arbitrary SQL queries via the deletecontact.php program...
Serv-U 2.5i DoS
Hi, I think I found another DoS issue in Serv-U 2.5i: I've downloaded the "Fixed" version of Serv-U yesterday. I installed it on one of my pc's and started windirRSRCMTR.EXE to see how many resources are used when I flood it. Then I started to play around with the server: Ftp open server Connecte...