Threat Outbreak Alert: Fake Product Quote Email Messages on July 31, 2013

Medium Alert ID: 30273 First Published: 2013 August 1 14:29 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product quote for the recipient. The text in the email message attempts to convince the recipient to open the...

Threat Outbreak Alert: Fake Product Quote Request Email Messages on July 17, 2013

Medium Alert ID: 30123 First Published: 2013 July 18 13:08 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product quotation request for the recipient. The text in the email message attempts to convince the recipient t...

Threat Outbreak Alert: Fake Product Quote Request Email Messages on July 14, 2013

Medium Alert ID: 30078 First Published: 2013 July 15 12:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product order quotation for the recipient. The text in the email message attempts to convince the recipient to...

bluecms the latest version of the double-byte universal password into the background-bug warning-the black bar safety net

Brief description: bluecms the latest version i.e., v1. 6sp1,processing of login authentication when the variables are single quotes escaped, but can be used gbk double-byte coding the closing single quote and then comment to enter the background Detailed description: bluecms verify the login cod...

Java Web Start Double Quote Injection Remote Code Execution

Exploit for multiple platform in category remote exploits require 'msf/core' class Metasploit3 'Sun Java Web Start Double Quote Injection', 'Description' = %q This module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. Parameters intial-heap-size and max-heap-size ...

Java - Web Start Double Quote Injection Remote Code Execution (Metasploit)

======================================================== Java Web Start Double Quote Inject Remote Code Execution ======================================================== Date: Jun 12 2012 updated: Jun 6 2013 Author: Rh0 Version: At least Java 1.6.31 to 1.6.35 and 1.7.03 to 1.7.07 Tested on:...

Sun Java Web Start Double Quote Injection

======================================================== Java Web Start Double Quote Inject Remote Code Execution ======================================================== Date: Jun 12 2012 updated: Jun 6 2013 Author: Rh0 Version: At least Java 1.6.31 to 1.6.35 and 1.7.03 to 1.7.07 Tested on:...

Sun Java Web Start Double Quote Injection Vulnerability

This Metasploit module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. Parameters intial-heap-size and max-heap-size in a JNLP file can contain a double quote which is not properly sanitized when creating the command line for javaw.exe. This allows the injection of...

discuz! 7.* Stored xss-vulnerability warning-the black bar safety net

Post flash at the address filter is not strict, resulting in the storage typexss. ! document. writeACFLRunContent'width', '5 5 0', 'height', '4 0 0', 'allowNetworking', 'internal', 'allowScriptAccess', 'never', 'src', 'aaaaaaaaaaaaa', 'quality', 'high', 'bgcolor', 'ffffff', 'wmode', 'transparent'...

CVE-2013-0110

nvSCPAPISvr.exe in the NVIDIA Stereoscopic 3D Driver service, as distributed with the NVIDIA driver before 307.78, and Release 310 before 311.00, on Windows, lacks " double quote characters in the service path, which allows local users to gain privileges via a Trojan horse program...

rubygem-actionpack: potential XSS vulnerability

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' quote character...

rubygem-actionpack: potential XSS vulnerability

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' quote character...

rubygem-actionpack: potential XSS vulnerability

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' quote character...

Sun Java Web Start Double Quote Injection

This module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. Parameters initial-heap-size and max-heap-size in a JNLP file can contain a double quote which is not properly sanitized when creating the command line for javaw.exe. This allows the injection of the...

CVE-2012-3464: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' quote character...

Potential XSS Vulnerability in Ruby on Rails

The HTML escaping code in Ruby on Rails does not escape all potentially dangerous characters. In particular the code does not escape the single quote character. The helpers used in Rails itself never use single quotes, so most applications are unlikely to be vulnerable, however all users running ...

ModSecurity引号解析安全限制绕过漏洞(CVE-2012-2751)

BUGTRAQ ID: 54156 CVE ID: CVE-2012-2751 modsecurity是经常与PHP结合使用的Web应用防火墙。 ModSecurity 2.6.6之前版本结合PHP使用时，没有正确处理单引号，可允许远程攻击者通过带有multipart/form-data Content-Type标头的请求内Content-Disposition字段中的请求参数的单引号，绕过过滤规则并执行诸如XSS攻击。 0 Breach Security modsecurity 2.x 厂商补丁： Breach Security ---------------...

CVE-2009-5031

ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting XSS attacks via a single quote in a request parameter in the Content-Disposition field of a...

CVE-2009-5031

CVE-2009-5031 affects ModSecurity before 2.5.11. It mishandles single quotes in request parameter values in the Content-Disposition header of multipart/form-data requests, allowing remote attackers to bypass filtering and perform other attacks such as XSS. A fix is available in ModSecurity 2.5.11...

CVE-2012-2751

CVE-2012-2751 relates to ModSecurity prior to 2.6.6 when used with PHP. The issue arises in how single quotes in Content-Disposition are handled inside multipart/form-data requests, allowing remote attackers to bypass filtering rules and potentially perform XSS. The vulnerability is noted to exis...