Location bar and SSL indicator spoofing via window.open() on invalid URL — Mozilla

Security researcher Juan Pablo Lopez Yacubian reported that an attacker could call window.open on an invalid URL which looks similar to a legitimate URL and then use document.write to place content within the new document, appearing to have come from the spoofed location. Additionally, if the...

CVE-2009-2217

Cross-site scripting XSS vulnerability in NBBC before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via an invalid URL in a BBCode img tag...

CVE-2009-2217

Cross-site scripting XSS vulnerability in NBBC before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via an invalid URL in a BBCode img tag...

Cross site scripting

Cross-site scripting XSS vulnerability in NBBC before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via an invalid URL in a BBCode img tag...

Design/Logic Flaw

pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url parameter, which reveals the installation path in an error message...

ManageEngine Applications Manager Invalid URL Remote Information Disclosure

The version of ManageEngine Applications Manager installed on the remote host is affected by an information disclosure vulnerability due to the application returning a summary of monitor groups and alerts in response to a request with an invalid URL. A remote attacker, using a URL with an invalid...

Unfixed XSS vulnerability at www.s-bahn-berlin.de

Security researcher Renoized, has submitted on 03/10/2007 a cross-site-scripting XSS vulnerability affecting www.s-bahn-berlin.de, which at the time of submission ranked 142061 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 03/10/2007. It is...

CVE-2005-0188

Format string vulnerability in the SetBaseURL function in AtHoc toolbar allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log...

CVE-2004-1912

The 1 modules.php, 2 block-Calendar.php, 3 block-Calendar1.php, 4 block-Calendarcenter.php scripts in NukeCalendar 1.1.a, as used in PHP-Nuke, allow remote attackers to obtain sensitive information via a URL with an invalid argument, which reveals the full path in an error message...

CVE-2005-0188

Format string vulnerability in the SetBaseURL function in AtHoc toolbar allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log...

Directory content leakage in KF Web Server

Invalid processing of 00 in URLs...

CVE-2000-0858

CVE-2000-0858 targets Microsoft Windows NT 4.0 with Internet Information Services (IIS). The issue occurs when an IIS process (INETINFO.EXE) processes a sequence of malformed requests, leading to a denial-of-service condition. Affected component is IIS on Windows NT 4.0; root cause is malformed r...

CVE-2000-0858

Vulnerability in Microsoft Windows NT 4.0 allows remote attackers to cause a denial of service in IIS by sending it a series of malformed requests which cause INETINFO.EXE to fail, aka the "Invalid URL" vulnerability...

CVE-2000-0710

The shtml.exe component of Microsoft FrontPage 2000 Server Extensions 1.1 allows remote attackers to determine the physical path of the server components by requesting an invalid URL whose name includes a standard DOS device name...

Security Bulletin (MS00-063)

Microsoft Security Bulletin MS00-063 - -------------------------------------- Patch Available for "Invalid URL" Vulnerability Originally posted: September 05, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Internet Information Server IIS...