197 matches found
CVE-2006-3197
Cross-site scripting XSS vulnerability in Invision Power Board IPB 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a POST that contains hexadecimal-encoded HTML...
CVE-2005-0649
Pixel-Apes SafeHTML before 1.2.1 allows remote attackers to bypass cross-site scripting XSS protection via "hexadecimal HTML entities."...
CVE-2005-0649
Pixel-Apes SafeHTML before 1.2.1 allows remote attackers to bypass cross-site scripting XSS protection via "hexadecimal HTML entities."...
CVE-2005-0649
Pixel-Apes SafeHTML prior to version 1.2.1 is vulnerable to bypassing XSS protection via hexadecimal HTML entities. Affected: SafeHTML component (pre-1.2.1). Root cause: input handling allows bypass of HTML entity encoding to defeat XSS protections. Impact: potential remote XSS. Exploitation deta...
RealPlayer 10.5 Denial of Service and possible Overflow
Well i was trying to find something in .ra format. I found something interestingI think I had an old .Ra and tryed to change some information of the filevia an hexadecimal editor: All my .ra files begin always with the following code: .ra......ra4.........r.........................+........ If i...
[SA13869] SafeHTML Hexadecimal HTML Entities Security Bypass
TITLE: SafeHTML Hexadecimal HTML Entities Security Bypass SECUNIA ADVISORY ID: SA13869 VERIFY ADVISORY: http://secunia.com/advisories/13869/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: SafeHTML 1.x http://secunia.com/product/4527/ DESCRIPTION: Christian...
[Full-Disclosure] NetSupport School Pro: Password encryption weaknesses
Vendor : NetSupport URL : http://www.netsupport-inc.com/ Version : Invision NetSupport School Pro Risk : Password protection weakness Description: NetSupport School, market leading training tool for the modern classroom featuring full student remote control, application & internet monitoring,...
CVE-1999-1273
Squid Internet Object Cache 1.1.20 allows users to bypass access control lists ACLs by encoding the URL with hexadecimal escape sequences...
Still a cgi-security hole in DNSTools (1.10)
Hi, following the notice about Version 1.08 of Dnstools I looked into the new version 1.10 that is currently downloadable on dnstools.com. It still contains a sedurity bug by not parsing input-values. Details: I saw the author improved the script by entering the subroutine ParseForSecurity. There...
CVE-2000-0081
The CVE-2000-0081 entry concerns Hotmail and the improper filtering of JavaScript code in a user’s mailbox. The vulnerability lets a remote attacker execute JavaScript by bypassing filters with hexadecimal encoding of the javascript: protocol (for example jAvascript). Affected product is Hotmail;...
hotmail.java.txt
Georgi Guninski security advisory 5, 2000 Yet another Hotmail security hole - injecting JavaScript using "jvascript:" Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual standard disclaimer applies, especially the fact that Georgi Guninski ...
PT-2000-1070 · Microsoft · Hotmail
Name of the Vulnerable Software and Affected Versions: Hotmail affected versions not specified Description: The issue concerns the improper filtering of JavaScript code from a user's mailbox. This allows a remote attacker to execute JavaScript code by using hexadecimal codes to specify the...
CVE-1999-1273
Squid Internet Object Cache 1.1.20 allows users to bypass access control lists ACLs by encoding the URL with hexadecimal escape sequences...
MS:1E64A253-B27A-498F-AF53-3B140CC1525D
...
MS:3A434D1C-BC51-4762-A37F-50ECACD9CEF4
...