CVE-2004-0760

Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character %00 in an FTP URI...

CVE-2004-0760

Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character %00 in an FTP URI...

CVE-2004-0595

The striptags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null \0 characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and...

Fedora Core 1 : squid-2.5.STABLE3-1.fc1 (2004-104)

Tue Mar 09 2004 Jay Fenlason 7:2.5.STABLE3-1.fc1 - Backport security fix for %00 hole. See CVE-2004-0189: The '%xx' URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL '%00' character, which causes Squid to use only a portion...

CVE-2004-0632

CVE-2004-0632: Adobe Reader/Acrobat Reader 6.x is vulnerable to a buffer overflow caused by improper handling of NULL characters when splitting a filename path into components, allowing remote code execution via a crafted file with a long extension. The issue affects Adobe Reader 6.0 (and 6.0.x v...

PHP strip_tags protection bypass

Insertion null character into tag allow protection bypass for few browsers...

Outlook/Outlook Express NULL character DoS

Client hangs on POP3 receiving if message contains NULL character...

DEBIAN-CVE-2004-0189

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...

CVE-2004-0189

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...

CVE-2003-0975

Apple Safari 1.0 through 1.1 on Mac OS X 10.3.1 and Mac OS X 10.2.8 allows remote attackers to steal user cookies from another domain via a link with a hex-encoded null character %00 followed by the target domain...

CVE-2003-0768

CVE-2003-0768 concerns Microsoft ASP.NET 1.1. The description across provided sources states that remote attackers can bypass the Cross-Site Scripting (XSS) and Script Injection protection feature by injecting a null character at the beginning of a tag name. The connected documents confirm the af...

ASP.NET crossite scripting protection bypass

It's possible to insert null character after tag opening...

Advisory: Incorrect Handling of XSS Protection in ASP.Net

Monday, September 8th, 2003 Background: ---------- As part of Microsoft's attempts to make it easier for application developers to write secure code, Microsoft has added a new feature, named Request Validation, to the ASP.Net 1.1 framework. This feature is provides out of the box protection again...

JBoss %00 Request JSP Source Disclosure

It is possible to make the remote web server disclose the source code of its JSP pages by appending a NULL character to the name of the JSP files requested eg, 'foo.jsp%00'. An attacker may use this flaw to get the source code of scripts on the remote host and possibly obtain passwords and other...

CVE-2002-1031

KeyFocus KF web server 1.0.2 allows remote attackers to list directories and read restricted files via an HTTP request containing a %00 null character...

CVE-2002-1031

CVE-2002-1031 affects KeyFocus (KF) web server 1.0.2. The vulnerability permits remote attackers to list directories and read restricted files through an HTTP request containing a null byte (%00). The NVD analysis indicates network access with low attack complexity and no authentication, resultin...

Apache Tomcat Directory Listing and File Disclosure

Apache Tomcat prior to 3.3.1a is affected by a directory listing and file disclosure vulnerability. By requesting URLs containing a null character, remote attackers can list directories even when an index.html or other file is present or obtain unprocessed source code for a JSP file. Also note...

CVE-2003-0042

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character...

CVE-2003-0042

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character...

CVE-2002-1031

KeyFocus KF web server 1.0.2 allows remote attackers to list directories and read restricted files via an HTTP request containing a %00 null character...