682 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in listads.php in YourFreeWorld Ultra Classifieds Pro allows remote attackers to inject arbitrary web script or HTML via the cn parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2009-3540
Cross-site scripting XSS vulnerability in listads.php in YourFreeWorld Ultra Classifieds Pro allows remote attackers to inject arbitrary web script or HTML via the cn parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
libneon certificate spoofing
Invalid NULL character processing in CN field...
CVE-2009-2474
neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...
Cross site scripting
Cross-site scripting XSS vulnerability in analyse.php in CAcert 20080921, and possibly other versions before 20080928, allows remote attackers to inject arbitrary web script or HTML via the CN CommonName field in the subject of an X.509 certificate...
8 6 8 4. CN bus query mesh search page leading to cross-site vulnerability-vulnerability warning-the black bar safety net
Author: Nobug32 Starters: Tosec. CN Affected versions: Only 8 6 8 4. CN similar bus program Description: Program when the query has not been strictly over, a direct result of cross-site vulnerability of the produce Attack test code...
firefox: does not properly prevent the literal rendering of homoglyph characters in IDN domain names (spoof URLs and conduct phishing attacks)
The Internationalized Domain Names IDN blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by...
Design/Logic Flaw
The Internationalized Domain Names IDN blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by...
phpcmssp6 digg, member.php update vulnerability demo-a vulnerability warning-the black bar safety net
phpcmssp6 broke the wide-character encoding hole, comrades, is to play very cool, 10.1 classic injected again played, thanks again for found. Here we demonstrate the use of the method, after all, there are many small black dry looking bad, exp came out, we directly use the well, The exp code into...
ASPXshell MS08-0 6-7 plugin-vulnerability warning-the black bar safety net
Author: cnqing ASPXshell MS08-0 6-7 plugin Thanks for the hi masses of the Brotherhood test, and comes with several plug-ins that. 1. Sweep writable directory plugin Method of use: set the scanning starting directory, set the scan success N after a stop, scanning. ! 2. No component package plug-i...
MS Windows Server Service Code Execution Exploit (MS08-067) (cn univ.)
No description provided by source. MS08-067 Exploit for CN by EMM exploit: http://www.sebug.net/bbs/viewthread.php?tid=397 http://milw0rm.com/sploits/2008-MS08-067.rar...
Microsoft Windows Server - Universal Code Execution (MS08-067)
MS08-067 Exploit for CN by EMM exploit: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6841.rar 2008-MS08-067.rar milw0rm.com 2008-10-26...
Unfixed XSS vulnerability at bag98.cn
Security researcher PD, has submitted on 31/03/2008 a cross-site-scripting XSS vulnerability affecting bag98.cn, which at the time of submission ranked 1480896 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/04/2008. It is currently unfixed...
Mozilla Foundation Security Advisory 2008-13
Mozilla Foundation Security Advisory 2008-13 Title: Multiple XSS vulnerabilities from character encoding Impact: Moderate Announced: March 25, 2008 Reporter: Alexey Proskuryakov, Yosuke Hasegawa, Simon Montagu Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.12 Thunderbird 2.0.0....
Unfixed XSS vulnerability at bag98.cn
Security researcher PD, has submitted on 16/03/2008 a cross-site-scripting XSS vulnerability affecting bag98.cn, which at the time of submission ranked 1331430 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/04/2008. It is currently unfixed...
Design/Logic Flaw
KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product, which make...
Code injection
Apple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid...
Unfixed XSS vulnerability at www.dm123.cn
Security researcher BackDoor, has submitted on 12/09/2007 a cross-site-scripting XSS vulnerability affecting www.dm123.cn, which at the time of submission ranked 39556 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/09/2007. It is currently...
Unfixed XSS vulnerability at www.in9.cn
Security researcher BackDoor, has submitted on 12/09/2007 a cross-site-scripting XSS vulnerability affecting www.in9.cn, which at the time of submission ranked 101796 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/09/2007. It is currently...
Net: HTTP insufficient verification of SSL certificate
The connect method in lib/net/http.rb in the 1 Net::HTTP and 2 Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName CN field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions v...