Code injection

Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL. NOTE: the severity of this issue has been disputed by a reliable third party, since the intended functionality of the status bar allows it to be...

CVE-2006-5152

Cross-site scripting XSS vulnerability in Microsoft Internet Explorer allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL that is returned in a large HTTP 404 error message without an explicit charset, a related issue to CVE-2006-0032...

CVE-2006-5152: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Microsoft Internet Explorer allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL that is returned in a large HTTP 404 error message without an explicit charset, a related issue to CVE-2006-0032...

CVE-2006-5037

MySource Matrix after 3.8 allows remote attackers to use the application as an HTTP proxy server via a MIME encoded URL in the sqcontentsrc parameter to access arbitrary sites with the server's IP address and conduct cross-site scripting XSS attacks. NOTE: the researcher reports that "The vendor...

CVE-2006-5037

MySource Matrix after 3.8 allows remote attackers to use the application as an HTTP proxy server via a MIME encoded URL in the sqcontentsrc parameter to access arbitrary sites with the server's IP address and conduct cross-site scripting XSS attacks. NOTE: the researcher reports that "The vendor...

CVE-2006-5037

CVE-2006-5037 affects MySource Matrix versions after 3.8. The issue allows remote attackers to use the application as an HTTP proxy via a MIME-encoded URL in the sq_content_src parameter, enabling access to arbitrary sites using the server’s IP and enabling cross-site scripting (XSS). The PT-2006...

PT-2006-5778 · Matrix · Matrix

Name of the Vulnerable Software and Affected Versions: Matrix versions after 3.8 Description: The issue allows remote attackers to use the application as an HTTP proxy server via a MIME encoded URL in the sq content src parameter. This can be used to access arbitrary sites with the server's IP...

CVE-2006-0032: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose...

CVE-2004-1517

Zone Labs IMsecure and IMsecure Pro before 1.5 allow remote attackers to bypass Active Link Filtering via an instant message containing a URL with hex encoded file extensions...

CVE-2004-1362

The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded...

CVE-2001-1118

CVE-2001-1118 affects Roxen Web platform (Roxen 2.0 prior to 2.0.92 and Roxen 2.1 prior to 2.1.264). The issue is a failure to properly decode UTF-8, Mac, and ISO-2202 encoded URLs, enabling a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL. Affected compo...

CVE-2001-1217: Undefined Security Weakness

Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. dot dot sequences...

CVE-2001-0784: Undefined Security Weakness

Directory traversal vulnerability in Icecast 1.3.10 and earlier allows remote attackers to read arbitrary files via a modified .. dot dot attack using encoded URL characters...

SimpleServer:WWW 1.0.7/1.0.8/1.13 - Hex Encoded URL Directory Traversal

source: https://www.securityfocus.com/bid/3112/info SimpleServer:WWW is a freely available HTTP daemon available from AnalogX. It is designed for simplicity of operation. A problem with the web server could allow a remote user to execute arbitrary commands, and potentially gain local access to th...

SimpleServer:WWW 1.0.71.0.81.13 - Hex Encoded URL Directory Traversal

SimpleServer:WWW 1.0.71.0.81.13 - Hex Encoded URL Directory Traversal source: https://www.securityfocus.com/bid/3112/info SimpleServer:WWW is a freely available HTTP daemon available from AnalogX. It is designed for simplicity of operation. A problem with the web server could allow a remote user ...

T. Hauck Jana Server 1.451.46 - Hex Encoded Directory Traversal

T. Hauck Jana Server 1.451.46 - Hex Encoded Directory Traversal source: https://www.securityfocus.com/bid/2703/info It is possible for a remote user to traverse the directories of a host running Jana Server. Submitting a specially crafted URL using hex encoded 'double dot' sequences will reveal...

AnalogX SimpleServer:WWW 1.0.6 - Directory Traversal

source: https://www.securityfocus.com/bid/1508/info Requesting a specially formed url containing encoding %2E to SimpleServer 1.06 and possibley earlier versions, will enable a remote user to gain read access to known files above the SimpleServer directory. http://target/%2E%2E/filename...