CVE-2008-4822

Adobe Flash Player/Flash plugin is affected by CVE-2008-4822, which describes a flaw in interpreting policy files that could bypass a non-root domain policy. Public advisories (e.g., RHSA-2008-0980 for Red Hat systems and GLSA-2009-03-23 for Gentoo) note that Flash policy interpretation issues we...

OpenNMS 1.5.x - HTTP Response Splitting

OpenNMS 1.5.x - HTTP Response Splitting source: https://www.securityfocus.com/bid/31577/info OpenNMS is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data. Attackers can leverage this issue to influence or misrepresent how web content is...

CVE-2008-4242

ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery CSRF attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web...

Fedora 8 : phpMyAdmin-2.11.7-1.fc8 (2008-5640)

"This update solves PMASA-2008-4 phpMyAdmin security announcement from 2008-06-23: XSS on plausible insecure PHP installation; see http://www.phpmyadmin.net/homepage/security.php?issue=PMASA-2008-4 - interface New field cannot be auto-increment and primary key - dbi Incorrect interpretation for...

Safari 3.1.1 Multiple Vulnerabilities for windows

I found a number of flaws in the browser Safari 3.1.1. The first is a way to make spoofing "falsify direction". Is that as we all know many browser to put eg [email protected] This attempt to connect to the domain after the @ user and use the first word or letters that we have, this is not today becau...

Input validation

Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service PHP outage and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted a-z argument as ...

CVE-2008-1734

Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service PHP outage and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted a-z argument as ...

CVE-2008-1734

CVE-2008-1734 affects Gentoo Linux users running the Gentoo PHP Toolkit prior to 1.0.1. The vulnerability arises from an interpretation conflict where an unquoted [a-z] argument can be treated as a shell glob instead of a literal string, allowing local users to cause a Denial of Service (PHP outa...

Debian Security Advisory DSA 958-1 (drupal)

The remote host is missing an update to drupal announced via advisory DSA 958-1. Several security related problems have been discovered in drupal, a fully-featured content management/discussion engine. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities:...

CVE-2008-0273

Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting XSS attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but are processed as UTF-8...

CVE-2007-6629

Interpretation conflict in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service NULL dereference and daemon crash via a User-Agent header line that contains a carriage-return character, which is considered a line delimiter when the header is split into individual...

Input validation

Interpretation conflict in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service NULL dereference and daemon crash via a User-Agent header line that contains a carriage-return character, which is considered a line delimiter when the header is split into individual...

CVE-2007-5934

The CVE-2007-5934 issue affects the PHP MDB2 project (MDB2 and its mysqli/ mysql drivers) where the LOB functionality incorrectly interprets a request to store a URL string as a request to fetch and store the contents of that URL. This can allow an MDB2-based application to act as an indirect pro...

Hardcoded credentials

Interpretation conflict in the Sun Java Virtual Machine JVM allows user-assisted remote attackers to conduct a multi-pin DNS rebinding attack and execute arbitrary JavaScript in an intranet context, when an intranet web server has an HTML document that references a "mayscript=true" Java applet...

CVE-2007-5375

Interpretation conflict in the Sun Java Virtual Machine JVM allows user-assisted remote attackers to conduct a multi-pin DNS rebinding attack and execute arbitrary JavaScript in an intranet context, when an intranet web server has an HTML document that references a "mayscript=true" Java applet...

Design/Logic Flaw

Interpretation conflict in WinSCP before 4.0.4 allows remote attackers to perform arbitrary file transfers with a remote server via file-transfer commands in the final portion of a 1 scp, and possibly a 2 sftp or 3 ftp, URL, as demonstrated by a URL specifying login to the remote server with a...

CVE-2007-4909

Interpretation conflict in WinSCP before 4.0.4 allows remote attackers to perform arbitrary file transfers with a remote server via file-transfer commands in the final portion of a 1 scp, and possibly a 2 sftp or 3 ftp, URL, as demonstrated by a URL specifying login to the remote server with a...

CVE-2007-4909: Undefined Security Weakness

Interpretation conflict in WinSCP before 4.0.4 allows remote attackers to perform arbitrary file transfers with a remote server via file-transfer commands in the final portion of a 1 scp, and possibly a 2 sftp or 3 ftp, URL, as demonstrated by a URL specifying login to the remote server with a...

CVE-2007-3930

Interpretation conflict between Microsoft Internet Explorer and DocuWiki before 2007-06-26b allows remote attackers to inject arbitrary JavaScript and conduct cross-site scripting XSS attacks when spellchecking UTF-8 encoded messages via the spellutf8test function in lib/exe/spellcheck.php, which...

CVE-2007-3930

The CVE-2007-3930 entry concerns a XSS vulnerability in DokuWiki’s spellchecker backend. Affects DokuWiki spellcheck.php (lib/exe/spellcheck.php) where the spell_utf8test path triggers HTML document identification and script execution by Internet Explorer when validating UTF-8 messages, even if t...