216 matches found
Mod_Security ASCIIZ字节绕过安全限制漏洞
modsecurity是经常与PHP结合使用的Web应用防火墙。 modsecurity在处理特定的HTTP数据时存在漏洞，远程攻击者可能利用此漏洞绕过某些安全限制。 在接收到请求后modsecurity会将其解析成为Web应用参数。由于解析入站数据的方式遵循RFC中所定义的规则而不一定是Perl、Python、Java或PHP中的HTTP请求解析器所兼容的方式，因此如果RFC与实际实现方式不匹配时可能存在一些限制绕过漏洞。...
CVE-2007-1359: Undefined Security Weakness
Interpretation conflict in ModSecurity modsecurity 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ 0x00 byte, which modsecurity treats as a terminator even though it is still processed as normal data by some...
mod_security <= 2.1.0 (ASCIIZ byte) POST Rules Bypass Vulnerability
Exploit for multiple platform in category remote exploits =================================================================== modsecurity = 2.1.0 ASCIIZ byte POST Rules Bypass Vulnerability =================================================================== modsecurity = 2.1.0 ASCIIZ byte POST...
mod_security 2.1.0 - ASCIIZ byte POST Rules Bypass
modsecurity 2.1.0 - ASCIIZ byte POST Rules Bypass modsecurity Now call it with a command like $ echo -e "&var=alert/xss/;" postdata $ curl http://localhost/test.php --data-binary...
mod_security 2.1.0 - ASCIIZ byte POST Rules Bypass
modsecurity Now call it with a command like $ echo -e "&var=alert/xss/;" postdata $ curl http://localhost/test.php --data-binary @postdata -A HarmlessUserAgent alert/xss/; The examp...
mod_security protection bypass
Invalid handling of NULL byte in POST form data opens possibility to traverse checks...
BONUS-12-2007:mod_security POST Rules Bypass Vulnerability
Summary modsecurity is a web application firewall often used in combination with PHP. It is usually used to block attacks based on patterns defined by regular expressions. Therefore it tries to parse the incoming HTTP request into what it believes to be parameters for the web application and logs...
oracle-xss.txt
Description --------------- There are plenty hundreds of Cross Site Scripting vulnerabilities in the Oracle Portal. The following is one that you may found in any version:...
Oracle Applications/Portal 9i/10g Cross Site Scripting
Description --------------- There are plenty hundreds of Cross Site Scripting vulnerabilities in the Oracle Portal. The following is one that you may found in any version:...
CVE-2003-1171
Heap-based buffer overflow in the secfilterout function in modsecurity 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execute arbitrary code via a server side script that sends a large amount of data...
CVE-2003-1171
The CVE-2003-1171 entry describes a heap-based buffer overflow in the sec_filter_out function of mod_security 1.7RC1 through 1.7.1 running on Apache 2, enabling remote code execution when a server-side script sends a large amount of data. Affected component: mod_security (Apache 2 integration). U...
CVE-2003-1171: Undefined Security Weakness
Heap-based buffer overflow in the secfilterout function in modsecurity 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execute arbitrary code via a server side script that sends a large amount of data...
ModSecurity for Apache vulnerable to off-by-one overflow when directive "SecFilterScanPost" is enabled
Overview A vulnerability in the modsecurity module for Apache may permit a remote attacker to execute arbitrary code on the vulnerable web server. Description ModSecurity is an open source intrusion detection and prevention engine for web applications. The modsecurity module for Apache 2.0.X...
CVE-2003-1171
Heap-based buffer overflow in the secfilterout function in modsecurity 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execute arbitrary code via a server side script that sends a large amount of data...
mod_security 1.7RC1 to 1.7.1 vulnerability
Program: modsecurity www.modsecurity.org Versions: 1.7RC1 to 1.7.1 Apache 2 version Synopsis: malloc based buffer overflow Author: Adam Dyga adeonato2.pl, adatadsystems.com.pl URL: http://adsystems.com.pl/adg-modsecurity171.txt Discovered: October 24, 2003 Published: October 28, 2003 Issue: There...