cups: web interface memory disclosure

The cgiinitializestring function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % percent character without two subsequent hex characters, which...

DEBIAN-CVE-2010-1748

The cgiinitializestring function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % percent character without two subsequent hex characters, which...

CVE-2010-1748

The cgiinitializestring function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % percent character without two subsequent hex characters, which...

RealPlayer: URL unescape buffer overflow

Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a URL argument containing a % percent...

PT-2008-4370 · Red Hat · Red Hat Adminutil

Name of the Vulnerable Software and Affected Versions: Red Hat adminutil version 1.1.6 Description: A heap-based buffer overflow issue exists, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via percent encoded HTTP input to unspecified CGI scripts in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway DSGW web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject...

CVE-2008-2929: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway DSGW web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject...

Server: multiple XSS issues

Multiple cross-site scripting XSS vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway DSGW web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject...

PT-2008-1472 · Apache +1 · Apache Tomcat +1

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.1.0 through 4.1.36 Apache Tomcat versions 5.5.0 through 5.5.25 Apache Tomcat versions 6.0.0 through 6.0.14 Description: The issue arises from improper handling of double quote " characters or %5C encoded backslash...

Windows IE7 URI Handler command execution through Firefox

Added: 10/19/2007 CVE: CVE-2007-3896 BID: 25945 OSVDB: 41090 Background The shell32.dll library provides functions which handle interaction between Internet Explorer and the Windows shell. Problem The version of the shell32.dll library installed with Internet Explorer 7 does not properly validate...

Windows IE7 URI Handler command execution through Firefox

Added: 10/19/2007 CVE: CVE-2007-3896 BID: 25945 OSVDB: 41090 Background The shell32.dll library provides functions which handle interaction between Internet Explorer and the Windows shell. Problem The version of the shell32.dll library installed with Internet Explorer 7 does not properly validate...

CVE-2004-2724: Improper Authentication

LionMax Software Chat Anywhere 2.72a allows remote attackers to cause a denial of service server crash and client CPU consumption via a username beginning with percent % followed by a null character...

CVE-2007-3837

Heap-based buffer overflow in HydraIRC 0.3.151 allows remote IRC servers to cause a denial of service application crash via a long CTCP request message containing '%' percent characters...

Design/Logic Flaw

web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to upload certain files 1 via a crafted filename or 2 by "using percent encoding in forms."...

CVE-2007-1832

The CVE-2007-1832 vulnerability affects web-app.org WebAPP prior to version 0.9.9.6. It allows remote authenticated users to upload certain files through two vectors: (1) via a crafted filename and (2) by using percent encoding in forms. The available sources describe the issue and confirm the up...

CVE-2007-1832

web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to upload certain files 1 via a crafted filename or 2 by "using percent encoding in forms."...

CVE-2007-1832: Undefined Security Weakness

web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to upload certain files 1 via a crafted filename or 2 by "using percent encoding in forms."...

CVE-2006-6753

Event Viewer eventvwr.exe in Microsoft Windows does not properly display log data that contains '%' percent characters, which might make it impossible to use Event Viewer to determine the actual data that triggered an event, and might produce long strings that are not properly handled by certain...

CVE-2006-6753

Event Viewer eventvwr.exe in Microsoft Windows does not properly display log data that contains '%' percent characters, which might make it impossible to use Event Viewer to determine the actual data that triggered an event, and might produce long strings that are not properly handled by certain...

CVE-2006-6753: Undefined Security Weakness

Event Viewer eventvwr.exe in Microsoft Windows does not properly display log data that contains '%' percent characters, which might make it impossible to use Event Viewer to determine the actual data that triggered an event, and might produce long strings that are not properly handled by certain...