CVE-2005-1180

HTTP Response Splitting vulnerability in the Surveys module in PHP-Nuke 7.6 allows remote attackers to spoof web content and poison web caches via hex-encoded CRLF "%0d%0a" sequences in the forwarder parameter...

CVE-2005-1005

CVE-2005-1005 affects ProfitCode PayProCart 3.0. The vulnerability allows remote attackers to bypass authentication and gain administrative privileges in the admin control panel by issuing a direct request to adminshop/index.php containing hex-encoded .. sequences in the ftoedit parameter, enabli...

CVE-2005-1005: Undefined Security Weakness

ProfitCode PayProCart 3.0 allows remote attackers to bypass authentication and gain administrative privileges to the admin control panel, as demonstrated via a direct request to adminshop/index.php with hex-encoded .. sequences in the ftoedit parameter...

CVE-2005-0831

The vulnerability CVE-2005-0831 affects PHP-Post and allows remote attackers to spoof other users’ names by registering with a username containing hex-encoded characters. The description is confirmed across multiple sources (NVD, Red Hat CVE entry, CVE List) and indicates weak input handling enab...

CVE-2005-0831: Undefined Security Weakness

PHP-Post allows remote attackers to spoof the names of other users by registering with a username containing hex-encoded characters...

CVE-2002-1599

Removed by vendor...

CVE-2002-1599: Undefined Security Weakness

DansGuardian before 2.4.5-1 allows remote attackers to bypass content filtering rules via hex-encoded URLs...

CVE-2005-0479

CVE-2005-0479 : The vulnerability affects TrackerCam (TrackerCam 5.12 and earlier). A directory traversal flaw exists in ComGetLogFile.php3 that allows remote attackers to read arbitrary files by supplying a manipulated fn parameter with .. sequences and variations such as / , ****, or hex-encode...

CVE-2004-1517: Undefined Security Weakness

Zone Labs IMsecure and IMsecure Pro before 1.5 allow remote attackers to bypass Active Link Filtering via an instant message containing a URL with hex encoded file extensions...

CVE-2005-0290: Undefined Security Weakness

NETGEAR FVS318 running firmware 2.4, and possibly other versions, allows remote attackers to bypass the filters using hex encoded URLs, as demonstrated using a hex encoded file extension...

CVE-2005-0054: Undefined Security Weakness

Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decodin...

CVE-2005-0290

NETGEAR FVS318 running firmware 2.4, and possibly other versions, allows remote attackers to bypass the filters using hex encoded URLs, as demonstrated using a hex encoded file extension...

CVE-2004-2363

Validate-Before-Canonicalize vulnerability in the checkURI function in functions.inc.php in PHPX 3.0 through 3.2.6 allows remote attackers to conduct cross-site scripting XSS attacks via hex-encoded tags, which bypass the check for literal "", "", and "" characters, as demonstrated using the limi...

CVE-2004-2294

Canonicalize-before-filter error in the sendreview function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leadin...

CVE-2004-2402

Cross-site scripting XSS vulnerability in YaBB.pl in YaBB 1 GOLD SP 1.3.2 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded to parameter. NOTE: some sources say that the board parameter is affected, but this is incorrect...

CVE-2004-1517

Zone Labs IMsecure and IMsecure Pro before 1.5 allow remote attackers to bypass Active Link Filtering via an instant message containing a URL with hex encoded file extensions...

CVE-2001-0902

Microsoft IIS 5.0 allows remote attackers to spoof web log entries via an HTTP request that includes hex-encoded newline or form-feed characters...

CVE-2001-0902: Undefined Security Weakness

Microsoft IIS 5.0 allows remote attackers to spoof web log entries via an HTTP request that includes hex-encoded newline or form-feed characters...

BEA WebLogic < 5.1.0 SP8 Hex-encoded Request JSP Source Disclosure

Binary data 1525.prm...

CVE-2004-2032

Netgear RP114 allows remote attackers to bypass the keyword based URL filtering by requesting a long URL, as demonstrated using a large number of %20 hex-encoded space sequences...