CVE-2010-4411: Undefined Security Weakness

Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors. NOTE: this issue exists because of an incomplete fix for CVE-2010-2761...

PT-2010-5487

Name of the Vulnerable Software and Affected Versions CGI.pm versions 3.50 and earlier Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. This problem exists due to an incomplete fix for a previous issue. Recommendations For...

IPfucK -- A Proxy tool for Firefox -- New Version

Having your IP address considered as private from a legal point of view, it is always interesting to increase your on-line privacy. Not only to hide your illegal activity indeed for most politicians and anti-fraud organizations, behind each surfers lives, but to just keep your personal informatio...

GroupWise Internet Agent < 8.0.2 HP1 Multiple Flaws

The version of GroupWise Internet Agent installed on the remote host is older than 8.0.2.11941 and hence affected by the following issues : - Multiple 'Content-Type' header parsing issues can result in arbitrary code execution on the remote system. ZDI-10-237 / ZDI-10-238 / ZDI-10-241 - Multiple...

Juniper Secure Access Series meeting_testjava.cgi XSS Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Juniper SA Series devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the meetingtestjava.cgi page which is used to test JVM compatibility. When...

PT-2010-4616

Name of the Vulnerable Software and Affected Versions Bugzilla versions prior to 3.2.9 Bugzilla versions 3.4.x prior to 3.4.9 Bugzilla versions 3.6.x prior to 3.6.3 Bugzilla versions 4.0.x prior to 4.0rc1 Description The issue allows remote attackers to inject arbitrary HTTP headers and content,...

Paypal.com Cross Site Scripting

https://www.paypal.com | HTTP Header Injection | Cross Site Scripting XSS | CAPEC-34 | CWE-79 Hoyt LLC - October 28, 2010 http://cloudscan.blogspot.com | http://cloudscan.me https://www.paypal.com | HTTP Header Injection | Cross Site Scripting XSS Tested on IE8, Chrome, Firefox. The affected URL'...

JVN#72541530: Active! mail 6 vulnerable to HTTP header injection

Active! mail 6 from TransWARE Co. is a web-based email software. Active! mail 6 contains a HTTP header injection vulnerability. Impact Falsified information may be displayed or an arbitrary script may be executed on the user's web browser. HTTP response splitting attacks are also possible. Soluti...

CVE-2010-3842

Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ backslash as a separator of path components within the Content-disposition HTTP header...

Path traversal

Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ backslash as a separator of path components within the Content-disposition HTTP header...

CVE-2010-3842

CVE-2010-3842 affects the curl command-line tool, specifically versions 7.20.0 through 7.21.1. The root cause is improper handling of backslashes as directory separators in the Content-Disposition header when using --remote-header-name (-J). This allows a remote server to cause the client to writ...

CVE-2010-3842

Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ backslash as a separator of path components within the Content-disposition HTTP header...

Oracle Sun Java System Web Server - HTTP Response Splitting

Oracle Sun Java System Web Server - HTTP Response Splitting Description Security-Assessment.com discovered that is possible to successfully perform an HTTP Response Splitting attack against applications served by Sun Java System Web Server. The vulnerability can be exploited if user supplied inpu...

ecshop advertising call page message header is written into the storms path-vulnerability warning-the black bar safety net

/affiche.php,php5 environmental error exposure program path, php4 environment to display the written information the charset parameter is not to do rigorous filtration result in an http message header truncated written...

[DCA-00015] YOPS Web Server Remote Command Execution

DCA-00015 Software - YOPS Your Open Personal WEB Server Vendor Product Description - YOPS Your Own Personal WEB Server is a small SEDA-like HTTP server for Linux OS written in C. There are 7 stages accept, parse, launch, fetch, error, send and log, and pipes are used as interstage channels. Bug...

CMSQLite 1.2 / CMySQLite 1.3.1 - Remote Code Execution

!/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Natural Killer "; if $argc 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n";...

RedHat Update for lftp RHSA-2010:0585-01

Check for the Version of lftp OpenVAS Vulnerability Test RedHat Update for lftp RHSA-2010:0585-01 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

Ubuntu 9.04 / 9.10 : firefox, firefox-3.0, xulrunner-1.9.2 vulnerability (USN-930-6)

USN-957-1 fixed vulnerabilities in Firefox and Xulrunner. Daniel Holbert discovered that the fix for CVE-2010-1214 introduced a regression which did not properly initialize a plugin pointer. If a user were tricked into viewing a malicious site, a remote attacker could use this to crash the browse...

Critical: Red Hat Security Advisory: thunderbird security update

An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity rating...

CVE-2010-2375: WebLogic Plugin HTTP Injection via Encoded URLs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: WebLogic Plugin HTTP Injection via Encoded URLs Release Date: 2010-07-13 Application: WebLogic Plugin...