CVE-2006-2783

Mozilla Firefox and Thunderbird before 1.5.0.4 strip the Unicode Byte-order-Mark BOM from a UTF-8 page before the page is passed to the parser, which allows remote attackers to conduct cross-site scripting XSS attacks via a BOM sequence in the middle of a dangerous tag such as SCRIPT...

Cross site scripting

Mozilla Firefox and Thunderbird before 1.5.0.4 strip the Unicode Byte-order-Mark BOM from a UTF-8 page before the page is passed to the parser, which allows remote attackers to conduct cross-site scripting XSS attacks via a BOM sequence in the middle of a dangerous tag such as SCRIPT...

DEBIAN-CVE-2006-2783

Mozilla Firefox and Thunderbird before 1.5.0.4 strip the Unicode Byte-order-Mark BOM from a UTF-8 page before the page is passed to the parser, which allows remote attackers to conduct cross-site scripting XSS attacks via a BOM sequence in the middle of a dangerous tag such as SCRIPT...

How in does not support the Upload file to the forum file upload-vulnerability warning-the black bar safety net

How in the does not support file upload Forum, Upload File To achieve this goal, there is a prerequisite for this forum to be able to upload pictures. Commonly used Picture format is generally as JPEG, this format is FFD9 as the end-of-file Mark, as to which after the Deposit of anything on the...

SUSE-SA:2006:017: sendmail

The remote host is missing the patch for the advisory SUSE-SA:2006:017 sendmail. The popular MTA sendmail is vulnerable to a race condition when handling signals. Under certain circumstances this bug can be exploited by an attacker to execute commands remotely. Sendmail was the default MTA in SuS...

security flaw

Multiple off-by-one errors in the cURL library libcurl 7.11.2 through 7.15.0 allow local users to trigger a buffer overflow and cause a denial of service or bypass PHP security restrictions via certain URLs that 1 are malformed in a way that prevents a terminating null byte from being added to...

Greasemonkey.txt

// Proof of concept exploits by Mark Pilgrim // 1 - Will disclose the contents of c:\boot.ini window.GMxmlhttpRequest = null; function trapGM03sPropertyName, sOldValue, sNewValue window.GMxmlhttpRequest = window.GMxmlhttpRequest; return sNewValue; function trapGM04sPropertyName, sOldValue,...

zlib security update

CentOS Errata and Security Advisory CESA-2005:569 Updated Zlib packages that fix a buffer overflow are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. Zlib is a general-purpose lossless data...

GLSA-200504-26 : Convert-UUlib: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-200504-26 Convert-UUlib: Buffer overflow A vulnerability has been reported in Convert-UUlib where a malformed parameter can be provided by an attacker allowing a read operation to overflow a buffer. The vendor credits Mark Martine...

New Vulnerability

I would like to submit a vulnerability that I just recently discovered. I have already contacted the vendor of the software that I discovered the bug in, but they have not gotten back to me. There are two Code Injection/CSS vulnerabilities that exist in Guestbook Version 1.51 by Chi Kien Uong...

More DBCC overruns SQL SEVER 2000

To compliment http://online.securityfocus.com/archive/1/284382/2002-07-20/2002-07-26/0 there also exists another two bufferoverruns. Although not documented on MS they are fixed in http://download.microsoft.com/download/SQLSVR2000/Patch/8.00.0667/W98NT4 2KMeXP/EN-US/8.00.0667enu.exe 1 DBCC...