CVE-2004-0189

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...

Squid Proxy 2.4/2.5 - NULL URL Character Unauthorized Access

source: https://www.securityfocus.com/bid/9778/info It has been reported that Squid Proxy may be prone to an unauthorized access vulnerability that may allow remote users to bypass access controls resulting in unauthorized access to attacker-specified resources. The vulnerability presents itself...

squid ACL bypass due to URL decoding bug

From the Squid advisory: Squid versions 2.5.STABLE4 and earlier contain a bug in the "%xx" URL decoding function. It may insert a NUL character into decoded URLs, which may allow users to bypass urlregex ACLs...

Apache Cygwin 1.3.x/2.0.x - Directory Traversal

source: https://www.securityfocus.com/bid/9733/info It has been reported that Apache may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. This issue is only reported to present itself in Apache running on...

Opera Browser 6.0 6 - URI Display Obfuscation

Opera Browser 6.0 6 - URI Display Obfuscation source: https://www.securityfocus.com/bid/9281/info A weakness has been reported in Opera that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI that is designed to access a specific location with a...

CVE-2003-0975

Apple Safari 1.0 through 1.1 on Mac OS X 10.3.1 and Mac OS X 10.2.8 allows remote attackers to steal user cookies from another domain via a link with a hex-encoded null character %00 followed by the target domain...

Unichat Vulnerabilities

Author: DarkKnight My site: http://www.insecureonline.com Product: Unichat Vendor Info.: Did not respond //Quote// "Come here," said the Spider to the Fly. Respected Just a few: ------------------- http://securityfocus.com http://eeye.com http://packetstormsecurity.nl http://jinxhackwear.com...

CVE-2003-0899

Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '' characters, which trigger the overflow when the characters are expanded to "" and "" sequences...

sh-httpd.txt

======================================== INetCop Security Advisory 2003-0x82-019 ======================================== Title: sh-httpd wildcard character' vulnerability 0x01. Description About: sh-httpd is a shell script-based Web server that supports GET and HEAD methods, and a CGI 1.1...

CVE-2003-0899: Incorrect Calculation of Buffer Size

Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '' characters, which trigger the overflow when the characters are expanded to "" sequences...

thttpd buffer overflow

Buffer overflow during characters escaping...

SH-HTTPD 0.30.4 - Character Filtering Remote Information Disclosure

SH-HTTPD 0.30.4 - Character Filtering Remote Information Disclosure source: https://www.securityfocus.com/bid/8897/info A problem has been identified in the handling of some characters by sh-httpd. Because of this, an attacker may be able to gain unauthorized access to information. GET GET...

[Full-Disclosure] sh-httpd `wildcard character' vulnerability

======================================== INetCop Security Advisory 2003-0x82-019 ======================================== Title: sh-httpd wildcard character' vulnerability 0x01. Description About: sh-httpd is a shell script-based Web server that supports GET and HEAD methods, and a CGI 1.1...

SH-HTTPD 0.3/0.4 - Character Filtering Remote Information Disclosure

source: https://www.securityfocus.com/bid/8897/info A problem has been identified in the handling of some characters by sh-httpd. Because of this, an attacker may be able to gain unauthorized access to information. GET GET ../../../sh-httpd/p GET /../../etc/s GET ../../root/.b...

PeopleSoft <LONGCHAR >and <VARCHAR> Data Upload

Vendor: PeopleSoft Solution ID: 200749181 Product: People Tools Version: 8.42, Others? Platform: Solaris 8, BEA WebLogic, Others? Remote/Local: Remote, Authenticated Title: Character Field Length Impact: Possible denial of service. Description: LONGCHAR and VARCHAR fields allow potentially large...

CVE-2003-0544

OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service crash via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used...

DSA-385 hztty - buffer overflows

Bulletin has no description...

minihttp file-sharing for net 1.5 - Directory Traversal

minihttp file-sharing for net 1.5 - Directory Traversal source: https://www.securityfocus.com/bid/8619/info It has been reported that WebForums and File-Sharing for NET are prone to a remote directory traversal attack due to insufficient sanitization of user-supplied data. This vulnerability coul...

CVE-2003-0768

CVE-2003-0768 concerns Microsoft ASP.NET 1.1. The description across provided sources states that remote attackers can bypass the Cross-Site Scripting (XSS) and Script Injection protection feature by injecting a null character at the beginning of a tag name. The connected documents confirm the af...

CVE-2003-0768: Undefined Security Weakness

Microsoft ASP.Net 1.1 allows remote attackers to bypass the Cross-Site Scripting XSS and Script Injection protection feature via a null character in the beginning of a tag name...