CVE-2008-4381

Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service application crash via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters...

Mozilla Foundation Security Advisory 2008-43

Mozilla Foundation Security Advisory 2008-43 Title: BOM characters, low surrogates stripped from JavaScript before execution Impact: Moderate Announced: September 23, 2008 Reporter: Dave Reed, Chris Weber, Gareth Heyes Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.0.2 Firefox...

Cross site scripting

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via byte order mark BOM characters that are removed from JavaScript code before...

Immunity Canvas: ALTN_SG

Name| altnsg ---|--- CVE| CVE-2008-4193 Exploit Pack| CANVAS Description| Alt-N Security Gateway 1.0.1 - Admin HTTP Server Overflow Notes| CVE Name: CVE-2008-4193 VENDOR: Alt-N Notes: Worst bad characters ever Repeatability: One shot References: http://osvdb.org/show/osvdb/45854 CVE Url:...

USN-645-1: Firefox and xulrunner vulnerabilities

Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. CVE-2008-0016 It was discovered that the same-origin check in Firefox...

Mozilla low surrogates stripped from JavaScript before execution

Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "jav&56325ascript" sequence, a...

Mozilla BOM characters stripped from JavaScript before execution

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via byte order mark BOM characters that are removed from JavaScript code before...

Mozilla BOM characters stripped from JavaScript before execution

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via byte order mark BOM characters that are removed from JavaScript code before...

CVE-2008-4188

Unspecified vulnerability in the TYPO3 Secure Directory kwsecdir extension before 1.0.2 allows remote attackers to execute arbitrary code via unknown vectors related to "injection of control characters."...

CVE-2008-4188

Unspecified vulnerability in the TYPO3 Secure Directory kwsecdir extension before 1.0.2 allows remote attackers to execute arbitrary code via unknown vectors related to "injection of control characters."...

BOM characters, low surrogates stripped from JavaScript before execution — Mozilla

Microsoft developer Dave Reed reported that certain BOM characters are stripped from JavaScript code before it is executed. This can lead to code, which would otherwise be treated as part of a quoted string, to be executed. The issue could potentially be used by an attacker to bypass or evade...

CVE-2008-4106

WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the userlogin column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user's...

FreeBSD Ports: lighttpd

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

/bin/sh Polymorphic shellcode with printable ASCII characters

Exploit for generator platform in category shellcode ============================================================= /bin/sh Polymorphic shellcode with printable ASCII characters =============================================================...

/bin/sh Polymorphic shellcode with printable ASCII characters

/bin/sh Polymorphic shellcode with printable ASCII characters. Shellcode exploit for generator platform ======================================================================== /bin/sh Polymorphic shellcode with printable ASCII characters...

Important: Red Hat Security Advisory: libtiff security and bug fix update

Updated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged...

p5-UI-Dialog -- shell command execution vulnerability

Matthijs Kooijman reports: It seems that the whiptail, cdialog and kdialog backends apply some improper escaping in their shell commands, causing special characters present in menu item titles to be interpreted by the shell. This includes the backtick evaluation operator, so this constitutes a...

Security Best Practice: Familiarize Yourself with the ASCII Only Response Headers Protection

HTTP Protocol Inspection provides strict enforcement of the HTTP protocol, ensuring these sessions comply with RFC standards and common security practices. Various attacks use binary and other non-ASCII characters to deliver worms and other malicious content to web servers...

dotCMS 1.6 - id Local File Inclusion

dotCMS 1.6 - id Local File Inclusion ++++++++++++++++++++++++++++++++++++++++++++++++++++++ + script:dotCMS + home: http://www.dotcms.org + demo: http://www.dotcms.org/thedotcms/demos/demo.dot + founder: Don of h4cky0u.org + Vulnerability: Directory traversal...

Debian Security Advisory DSA 1611-1 (afuse)

The remote host is missing an update to afuse announced via advisory DSA 1611-1. OpenVAS Vulnerability Test $Id: deb16111.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1611-1 afuse Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...