Mandriva Linux Security Advisory : php (MDVSA-2010:008)

Multiple vulnerabilities has been found and corrected in php : The zendrestoreinientrycb function in zendini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information memory contents and cause a PHP crash by using the iniset function to declare...

CVE-2009-4142

The htmlspecialchars function in PHP before 5.2.12 does not properly handle 1 overlong UTF-8 sequences, 2 invalid ShiftJIS sequences, and 3 invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting XSS attacks by placing a crafted byte sequence before a special...

CVE-2009-4142: Improper Neutralization of Input During Web Page Generation

The htmlspecialchars function in PHP before 5.2.12 does not properly handle 1 overlong UTF-8 sequences, 2 invalid ShiftJIS sequences, and 3 invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting XSS attacks by placing a crafted byte sequence before a special...

PHP 'htmlspecialcharacters()'畸形多字节字符跨站脚本漏洞

Bugraq ID: 37389 CVE ID：CVE-2009-4142 PHP是一款流行的网络编程语言。 htmlspecialchars函数不严格检查多字节序列，远程攻击者可以利用漏洞进行跨站脚本攻击。 PHP PHP 5.2.11 PHP PHP 5.2.10 PHP PHP 5.2.9 PHP PHP 5.2.8 PHP PHP 5.2.7 PHP PHP 5.2.6 PHP PHP 5.2.5 PHP PHP 5.2.4 PHP PHP 5.2.3 PHP PHP 5.2.2 PHP PHP 5.2.1 PHP PHP 5.2 PHP...

Multiple browsers inherited charset crossite scripting

If age with undefined charset is displayed in frame, codepage of parent page is used. It makes it possible to conduct crossite scripting attack with e.g. UTF-7, EUC-JP SHIFTJIS charset...

Firefox's Charset Remembering strikes back

Здравствуйте 3APA3A! Сообщаю вам об изобретении мною новой атаки с использованием Charset Remembering уязвимости в Mozilla Firefox. Ранее я сообщал о Charset Remembering уязвимости в Mozilla Firefox http://websecurity.com.ua/2848/. Как я писал у себя на сайте, Mozilla отчасти исправила уязвимость...

CVE-2008-4446

Cross-site scripting XSS vulnerability in Nucleus EUC-JP 3.31 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Nucleus EUC-JP 3.31 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-4446

Cross-site scripting XSS vulnerability in Nucleus EUC-JP 3.31 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-4446

CVE-2008-4446 concerns a cross-site scripting (XSS) vulnerability in Nucleus EUC-JP Japanese Edition. The Nucleus CMS versions affected are v3.31 SP1 EUC-JP and earlier. The underlying issue is an XSS flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-4446: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Nucleus EUC-JP 3.31 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

JVN#92651529 Nucleus EUC-JP Japanese Edition vulnerable to cross-site scripting

Nucleus is an open source content management system provided by The Nucleus Group. Nucleus EUC-JP Japanese Edition contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the specific web browser. Solution Update the Software Apply the latest update provided b...