696 matches found
CVE-2010-2768
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting XSS...
Mozilla UTF-7 XSS by overriding document charset using <object> type attribute (MFSA 2010-61)
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting XSS...
Mozilla UTF-7 XSS by overriding document charset using <object> type attribute (MFSA 2010-61)
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting XSS...
Mozilla UTF-7 XSS by overriding document charset using <object> type attribute (MFSA 2010-61)
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting XSS...
Mozilla Firefox 3.6.x < 3.6.9 Multiple Vulnerabilities
Binary data 5657.prm...
UTF-7 XSS by overriding document charset using <object> type attribute — Mozilla
Security researchers David Huang and Collin Jackson of Carnegie Mellon University CyLab Silicon Valley campus reported that the type attribute of an tag can override the charset of a framed HTML document, even when the document is included across origins. A page could be constructed containing su...
CVE-2010-2768
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting XSS...
mod_proxy_ftp XSS
modproxyftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting XSS attacks using UTF-7 encoding...
httpd mod_status XSS
Cross-site scripting XSS vulnerability in modstatus.c in the modstatus module in Apache HTTP Server httpd, when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browser...
mod_autoindex XSS
Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...
CVE-2010-1382
Cross-site scripting XSS vulnerability in Wiki Server in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote authenticated users to inject arbitrary web script or HTML via crafted Wiki content, related to lack of a charset field...
Cross site scripting
Cross-site scripting XSS vulnerability in Wiki Server in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote authenticated users to inject arbitrary web script or HTML via crafted Wiki content, related to lack of a charset field...
CVE-2010-1382
Cross-site scripting XSS vulnerability in Wiki Server in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote authenticated users to inject arbitrary web script or HTML via crafted Wiki content, related to lack of a charset field...
CVE-2010-1382
The CVE-2010-1382 issue affects Apple Mac OS X Wiki Server: specifically OS X 10.5.8 and 10.6 before 10.6.4. The root cause is a lack of a charset field in Wiki content, enabling a cross-site scripting (XSS) vector. Impact stated: remote authenticated users can inject arbitrary web script or HTML...
ZDI-10-093: Apple Webkit CSS Charset Text Transformation Remote Code Execution Vulnerability
ZDI-10-093: Apple Webkit CSS Charset Text Transformation Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-093 June 8, 2010 -- CVE ID: CVE-2010-1770 -- Affected Vendors: Apple -- Affected Products: Apple WebKit -- TippingPointTM IPS Customer Protection:...
Windows Live Messenger Version 2009 DoS
Exploit for windows platform in category dos / poc ======================================= Windows Live Messenger Version 2009 DoS ======================================= Exploit Title: Windows Live Messenger Version 2009 Date: 16/2/2009 Author: Mr Ha1 / Morad Quraan Software Link:...
Date and Sex Vor und Ruckwarts Auktions System Blind SQL Injection
----------------------------Information------------------------------------------------ +Name : Date & Sex Vor und Rückwärts Auktions System 1 --------------------------------------------------------------------------------------...
Debian DSA-1910-1 : mysql-ocaml - missing escape function
It was discovered that mysql-ocaml, OCaml bindings for MySql, was missing a function to call mysqlrealescapestring. This is needed, because mysqlrealescapestring honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used. The adde...
Internet Explorer US-ASCII Charset Obfuscation (CVE-2006-3227)
Although various security products provide coverage against many web vulnerabilities, these known exploits could potentially bypass security products by using US-ASCII charset obfuscation techniques. Microsoft Internet Explorer contains a flaw related to the encoding Internet transmitted content...
