W3C Amaya ParseCharsetAndContentType()函数栈溢出漏洞

BUGTRAQ ID: 34389 Amaya是W3C出品的所见即所得的网页编辑/浏览器。 Amaya的XHTML解析器函数ParseCharsetAndContentType在处理特制HTML页面的charset类型时存在栈溢出漏洞。以下是/amaya/XHTMLbuilder.c中有漏洞的代码段： 68 void ParseCharsetAndContentType Element el, Document doc 69 70 71 AttributeType attrType; 72 Attribute attr; 73 ElementType elType; 74 CHARSET...

Amaya 11.1 XHTML Parser Remote Buffer Overflow PoC

No description provided by source. =cicatriz [email protected]==advisories= / / / / // / / // / o / / .-/ =Amaya 11.1 XHTML Parser Buffer Overflow==/= == =Advisory & Vulnerability Information=== Title: Amaya 11.1 XHTML Parser Buffer Overflow Advisory ID: VUDO-2009-0104 Advisory URL:...

phpinfo cross-site scripting vulnerability-vulnerability warning-the black bar safety net

Vulnerability description: php is a widely used programming language, can be nested in the html with a to do web app development. phpinfois used to display the current php environment is a function of many site and program will phpinfo on your own site or on a program, but phpinfo in the presence...

Multiple browsers inherited charset crossite scripting

If age with undefined charset is displayed in frame, codepage of parent page is used. It makes it possible to conduct crossite scripting attack with e.g. UTF-7, EUC-JP SHIFTJIS charset...

Firefox's Charset Remembering strikes back

Здравствуйте 3APA3A! Сообщаю вам об изобретении мною новой атаки с использованием Charset Remembering уязвимости в Mozilla Firefox. Ранее я сообщал о Charset Remembering уязвимости в Mozilla Firefox http://websecurity.com.ua/2848/. Как я писал у себя на сайте, Mozilla отчасти исправила уязвимость...

Microsoft MSN Live Messneger Denial of Service Vulnerability

This host is running Microsoft MSN Live Messenger and is prone to Denial of Service Vulnerability. OpenVAS Vulnerability Test $Id: secpodmslivemsngrcharsetdosvuln.nasl 8193 2017-12-20 10:46:55Z cfischer $ Microsoft MSN Live Messneger Denial of Service Vulnerability Authors: Sujit Ghosal Copyright...

Microsoft MSN Live Messneger Denial of Service Vulnerability

Microsoft MSN Live Messenger is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Format string

msnmsgr.exe in Windows Live Messenger WLM 2009 build 14.0.8064.206, and other 14.0.8064.x builds, allows remote attackers to cause a denial of service application crash via a modified header in a packet, as possibly demonstrated by a UTF-8.0 value of the charset field in the Content-Type header...

Charset Remembering vulnerability в Mozilla Firefox

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Charset Remembering уязвимости в Mozilla Firefox. Данная уязвимость приводит к возможности проведения XSS атак с UTF-7. При указании пользователем для страницы на сайте кодировки в частности, UTF-7, браузер запоминает данную кодировку и использует...

Charset Inheritance vulnerability in Internet Explorer 6 и Google Chrome

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Charset Inheritance уязвимости в Internet Explorer 6 и Google Chrome. В дополнение к ранее опубликованной информации http://securityvulns.ru/news/Browsers/Charset/XSS.html о данной уязвимости в других браузерах. Данная уязвимость в браузерах,...

FreeBSD : cgiwrap -- XSS Vulnerability (bc6a7e79-e111-11dd-afcd-00e0815b8da8)

Secunia reports : A vulnerability has been reported in CGIWrap, which can be exploited by malicious people to conduct cross-site scripting attacks. The vulnerability is caused due to the application generating error messages without specifying a charset. This can be exploited to execute arbitrary...

Cross site scripting

The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks via a CRLF sequence in conjunction with a crafted Content-Type header, as demonstrated by a header with a utf-7 charset value. NOTE: the vendor has...

Discuz!4.x wap\index.php 变量覆盖漏洞

Discuz!4.x一直存在着一个变量覆盖漏洞n年了.代码如下: $chs = ''; if$POST && $charset != 'utf-8' $chs = new Chinese'UTF-8', $charset; foreach$POST as $key = $value $$key = $chs-Convert$value; //foreach处理$POST导致变量覆盖 unset$chs;...

Buffer overflow security vulnerabilities in Java Web Start (CVE-2008-1189, CVE-2008-1190)

Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allow remote attackers to execute arbitrary code via a JNLP file with 1 a long key name in the xml header or 2 a long charset value, different issu...

Apache Tomcat allowLinking UTF-8 Traversal Arbitrary File Access

The version of Apache Tomcat running on the remote host is affected by a directory traversal vulnerability due to an issue with the UTF-8 charset implementation within the underlying JVM. An unauthenticated, remote attacker can exploit this, by encoding directory traversal sequences as UTF-8 in a...

Directory traversal

Directory traversal vulnerability in the usergetprofile function in include/functions.inc.php in Coppermine Photo Gallery CPG 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang part of serialized data in...

DEBIAN-CVE-2008-3197

Cross-site request forgery CSRF vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to 1 the db parameter in the "Creating a Database" functionality dbcreate.php, and 2 the convcharset and collationconnection parameters related...

XSRF/CSRF for creating a database and modifying user charset

PMASA-2008-5 Announcement-ID: PMASA-2008-5 Date: 2008-07-15 Updated: 2008-07-16 Summary XSRF/CSRF for creating a database and modifying user charset Description We received an advisory from Aung Khant YGN Ethical Hacker Group, and we wish to thank him for his work. A logged-in user, if abused int...

Triton CMS Pro (X-Forwarded-For) Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w Triton CMS Pro X-Forwarded-For Blind SQL Injection Admin's username/hash disclosure exploit Benchmark method, so take a coffee and relax Coded by GiReX use LWP::UserAgent; use HTTP::Request; ifnot defined $ARGV0 print "\nUsage: perl $0 host pat...

DEBIAN-CVE-2008-2667

SQL injection vulnerability in the Courier Authentication Library aka courier-authlib before 0.60.6 on SUSE openSUSE 10.3 and 11.0, and other platforms, when MySQL and a non-Latin character set are used, allows remote attackers to execute arbitrary SQL commands via the username and unspecified...