4265 matches found
CVE-2013-3166
CVE-2013-3166 is an XSS vulnerability in Microsoft Internet Explorer (IE6–IE10) that arises from incorrect auto‑selection of the Shift JIS encoding, enabling remote script/HTML execution via cross‑domain scrolling events. The issue is documented as the Shift JIS Character Encoding Vulnerability a...
backspace_between_dots
This evasion plugin inserts an A and a backspace control character between dots which cancel each other when they are processed and some filters that match ../ are bypassed. Example: Input: ../../etc/passwd Output: .%41%08./.%41%08./etc/passwd Plugin type Evasion Options This plugin doesnt have a...
CVE-2013-1968
Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service FSFS repository corruption via a newline character in a file name...
74CMS talent system v3. 2 injection and full version pass rounded out the background is attached using the EXP-bug warning-the black bar safety net
Set of procedures filter is still relatively full, but all versions are GBK encoding is his flawed but basically the string into the library when the author used the iconv to convert the submitted over the data encoding into utf8 So the use of wide-character injection there is no way out but the...
Fedora 17 : glibc-2.15-59.fc17 (2013-4174)
Fix multibyte character processing crash in regexp 922889, 905874, CVE-2013-0242 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...
1
kernel 2.6.18-348.6.1.0.1 - oprofile x86, mm: Add getuserpagesfast orabug 14277030 - oprofile export getuserpagesfast function orabug 14277030 - oprofile oprofile, x86: Fix nmi-unsafe callgraph support orabug 14277030 - oprofile oprofile: use KMNMI slot for kmapatomic orabug 14277030 - oprofile...
php character comparison Double equal characteristics may be references made to the security-vulnerability warning-the black bar safety net
Title party!, the The article is relatively short, ha ha! Before learning php, research. php auto similar conversion,this is php a feature, not a 0day,phper know something, There are similar perl. Straight cut body, we learn php know that“==”with”===”the difference,the former in the comparison of...
phpwind 9 /src/service/tag/dao/PwTagDao.php SQL注入漏洞
phpwind是国内一款流行的内容管理系统软件，其9版本/src/service/tag/dao/PwTagDao.php文件代码第116行的$tagName变量由$GET方式获得，代码117-119行拼接SQL语句，带入数据查询。在查询之前执行了/wind/db/mysql/WindMysqlPdoAdapter.php文件代码第24行设置编码为gbk，由此导致宽字节漏洞产生。 phpwind 9...
Gbbs micro Forum v3. 1. 4 injection vulnerability-vulnerability warning-the black bar safety net
Official address: http://www.softatm.com Vulnerability to prove:/css/ss.txt Program download: http://down.chinaz.com/soft/33484.htm Vulnerability files /userinfo. asp 7 2 row 7 row 4 Vulnerability type: character type injection Vulnerability information: p%yhm = request"yhm" set rs=server...
RedHat Update for glibc RHSA-2013:0769-01
The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Mandriva Linux Security Advisory : bogofilter (MDVSA-2013:064)
Updated bogofilter package fixes security vulnerability : In bogofilter before 1.2.3, bogofilter's/bogolexer's base64 could overwrite heap memory in the character set conversion in certain pathological cases of invalid base64 code that decodes to incomplete multibyte characters CVE-2012-5468...
Fedora 18 : glibc-2.16-30.fc18 (2013-4100)
Fix multibyte character processing crash in regexp CVE-2013-0242. Fix ownership of /usr/lib64/audit 894307. Rename release engineering directory to releng' 903754. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable...
Ruby Gem Fastreader 1.0.8 Code Execution
Ruby gem fastreader-1.0.8 remote code exec 3/6/2013 if the url contains any ; characters code will be executed as the user. for example if fastreader is fed http://www.g;id;.com id will be executed. ./fastreader-1.0.8/lib/entrycontroller.rb .strip only removes whitespace before and after the URL...
Ruby Gem Command Wrap Command Execution
Remote command execution in Ruby Gem Command Wrap 3/15/2013 http://rubygems.org/gems/commandwrap Commands executed if the remote URL or filename contains the shell character ';'. The commands will be executed as the client user if tricked into using the malicious URL or filename. Examining the...
Mac OS X 10.8 < 10.8.3 Multiple Vulnerabilities (Security Update 2013-001)
Binary data 801018.prm...
ftpd Gem for Ruby Shell Character Handling Remote Command Injection
ftpd Gem for Ruby contains a flaw that is triggered when handling a specially crafted option or filename that contains a shell character. This may allow a remote attacker to inject arbitrary commands...
Mastery OA contents of the log stored XSS can get the cookie-vulnerability warning-the black bar safety net
Mastery OA2013 and 2 0 1 0 version, Office Anywhere 2 0 1 3 work log edit page there is the storage typeXSS, and their superiors view the log after you can steal the cookie 1, the work log edit page source code to bypass the bypass a character can be constructedXSS! ! ! 1, the interception to giv...
pam security, bug fix, and enhancement update
1.1.1-13 - fix environment file handling problems - CVE-2011-3148 746619 and CVE-2011-3148 746620 1.1.1-12 - add character sequence test to pamcracklib - drop unused difignore option from pamcracklib 811243 - add enforceforroot option to pamcracklib 588893 - mention limits.d in the limits.conf5...
dzX 2.0/2. 5 pass to kill 0day stored XSS a gold-bug warning-the black bar safety net
The vulnerability occurs in the plug attachment to the place. Says to plug in the Annex you tell me what also should be thought about certainly is the file name. Because the file name is in accordance with the local Upload File name to be displayed. If youroperating systemis a linux you can...
