CVE-2008-5510

CVE-2008-5510 concerns the CSS parser in Mozilla Firefox (3.x up to 3.0.5 and 2.x up to 2.0.0.19), Thunderbird 2.x up to 2.0.0.19, and SeaMonkey 1.x up to 1.1.14, where the escaped null character (\0) is ignored, potentially allowing remote attackers to bypass sanitization protections. The descri...

CVE-2008-5510

The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 ignores the '\0' escaped null character, which might allow remote attackers to bypass protection mechanisms such as sanitization routines...

Firefox null characters ignored by CSS parser

The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 ignores the '\0' escaped null character, which might allow remote attackers to bypass protection mechanisms such as sanitization routines...

Character Encoding Inheritance in iframes Can Enable Cross-Site Scripting

Pages displayed inside an iframe will inherit the character encodingof the parent page, unless they specify their own character encoding.A malicious page that uses the UTF-7 character encoding can includeother sites, for example inside iframes. This can be exploited toperform cross-site scripting...

phpMyAdmin 3.1.0 - Cross-Site Request Forgery / SQL Injection

Written by Michael Brooks Special Thanks to str0ke and rGod Intro: phpMyAdmin is by far the most popular PHP project. Between phpmyadmin and the xampp project there are more than 34+ million downloads from sourceforge.net . This exploit was released along side XSRF attacks against XAMPP and Simpl...

On double-byte vulnerability-vulnerability warning-the black bar safety net

by profession owe money Yesterday spent the time to look at wide character of the problem, only to find that prior understanding has been wrong. %df' is a PHP escape（open GPC, with the addslashes function, or icov, etc., a single quotation mark is combined with the backslash\ Into %df' Where\hex...

openSUSE 10 Security Update : htop (htop-5824)

insufficient character filters in htop when displaying commands allowed programs that rewrite their program name to inject escape sequences CVE-2008-5076. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

[Backports-security-announce] Security Update for vim

Norbert Tretkowski uploaded new packages for vim which fixed the following security problems: CVE-2008-4101, Debian Bug 500381 Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to 1 execute arbitrary shell commands by entering a K keystro...

[Backports-security-announce] Security Update for vim

Norbert Tretkowski uploaded new packages for vim which fixed the following security problems: CVE-2008-4101, Debian Bug 500381 Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to 1 execute arbitrary shell commands by entering a K keystro...

Updated: Google Chrome 0.4.154.25 URI Meta Character URL Obfuscation

Hi All The Google chrome new version 0.4.154.25 is also suffering from this vulnerability.The full POC have been released at milw0rm. Have a look at it: http://milw0rm.com/exploits/7226 The problem is this most of web servers have anti viruses which treated it as URL Spoofing virus. Anyways the P...

Clean CMS 1.5 (full_txt.php id) Blind SQL Injection Exploit

No description provided by source. Clean CMS 1.5 fulltxt.php id Blind SQL Injection Exploit url: http://www.4yoursite.nl/scriptcleancms.php Author: JosS mail: sys-projectathotmaildotcom site: http://hack0wn.com && spanish-hackers.com team: Spanish Hackers Team - SHT This was written for education...

Fedora 9 : htop-0.8.1-2.fc9 (2008-9728)

Tue Nov 18 2008 Rafa Psota - 0.8.1-2 - non-printable character filter patch 504144 - Tue Oct 14 2008 Rafa Psota - 0.8.1-1 - update to 0.8.1 - Thu Jul 31 2008 Rafa Psota - 0.8-1 - udate to 0.8 - Sun Apr 27 2008 Rafa Psota - 0.7-2 - desktop file fix Note that Tenable Network Security has extracted...

JVN#67060882 sISAPILocation vulnerability bypasses HTTP header rewrite function

sISAPILocation, developed by an individual developer, is an ISAPI filter for IIS Internet Information Services. sISAPILocation contains a vulnerability that allows the HTTP header rewrite function to be bypassed. Impact When sISAPILocation is used to configure settings, such as to specify charact...

Design/Logic Flaw

Visual truncation vulnerability in Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar via a URL with a hostname containing many Non-Blocking Space character sequences, which are rendered as whitespace, aka MSRC ticket MSRC7899, a related issue to CVE-2003-1025...

PHP character encoding bypass vulnerability summary-vulnerability warning-the black bar safety net

Transferred from: neo Original address: http://www.cnblogs.com/Safe3/archive/2008/08/22/1274095.html In fact this stuff is one of the few hack has long been known, but not shared published. Some people are reluctant to share and prefer to rot in the ground, in addition some is used to profit. The...

Smarty 2.6.20 php injection

2008-10-22 числа Secunia.com была найдена уязвимость в функции expandquotedtext полный текст http://secunia.com/Advisories/32329/. Разработчики попытались исправить уязвимость как видно из их кода http://smarty-php.googlecode.com/svn/trunk/libs/SmartyCompiler.class.php путем экранированием символ...

DEBIAN-CVE-2008-4640

The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename in which 1 a final "z" character is replaced by a "t" character or 2 a final "t" character is replaced by a "z" character...

Apache mod_proxy_ftp Directory Component Wildcard Character Globbing XSS

The modproxyftp module in the version of Apache running on the remote host fails to properly sanitize user-supplied URL input before using it to generate dynamic HTML output. Using specially crafted requests for FTP URLs with globbing characters such as asterisk, tilde, opening square bracket, et...

MySQL命令行客户端HTML特殊字符HTML注入漏洞

BUGTRAQ ID:31486br / CNCAN ID：CNCAN-2008100103br / br / MySQL是一款开放源代码的数据库服务程序。br / MySQL命令行客户端没有对其输出进行过滤处理，远程攻击者可以利用漏洞获得敏感信息。br / MySQL命令行客户端在它的输出中对HTML特定字符如""缺少引用处理，允许攻击者写数据到表中来隐藏或修改输出的记录，并注入恶意代码，如通过Javascript执行跨站脚本或跨站请求伪造攻击。 MySQL AB MySQL 5.1.26 MySQL AB MySQL 5.1.23 MySQL AB MySQL 5.1.22 MySQ...

IP Reg <= 0.4 Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl ----------------------------------------------- IP Reg = 0.4 Blind SQL Injection Exploit Discovered By StAkeR - StAkeRathotmaildotit Discovered On 03/10/2008 ----------------------------------------------- Download...