CVE-2008-3843

CVE-2008-3843 describes a bypass of ASP.NET Request Validation (ValidateRequest filters) in the Microsoft .NET Framework when MS07-040 is installed. The vulnerability arises from the framework failing to properly detect dangerous input, enabling cross-site scripting (XSS) via crafted client data,...

CVE-2008-3842

Request Validation aka the ValidateRequest filters in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by a query string containing a "/"...

ScrewTurn-Wiki_08_008.txt

Portcullis Security Advisory 08008 Vulnerable System: ScrewTurn Wiki www.screwturn.eu. Vulnerability Title: Permanent Cross-site Scripting in the "System Log" page. Vulnerability Discovery And Development: Portcullis Security Testing Services. Credit For Discovery: Ferruh Mavituna - Portcullis...

Microsoft Windows XMLHTTP proxy problem

Because of insufficient request validation Msxml2.XMLHTTP ActiveX object can be used to proxy HTTML request via client browser...

Debian DSA-925-1 : phpbb2 - several vulnerabilities

Several vulnerabilities have been discovered in phpBB, a fully featured and skinnable flat webforum. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-3310 Multiple interpretation errors allow remote authenticated users to inject arbitrary web script...

CVE-2005-3537

A "missing request validation" error in phpBB 2 before 2.0.18 allows remote attackers to edit private messages of other users, probably by modifying certain parameters or other inputs...

CVE-2005-3537

A "missing request validation" error in phpBB 2 before 2.0.18 allows remote attackers to edit private messages of other users, probably by modifying certain parameters or other inputs...

CVE-2005-3537

CVE-2005-3537 affects phpBB 2 before 2.0.18, with a missing input/request validation flaw that enables remote attackers to edit private messages of other users by tampering with parameters or inputs. Public records in multiple feeds (NVD, Debian DSA, Red Hat, OpenVAS listings) confirm the vulnera...

CVE-2005-3537

A "missing request validation" error in phpBB 2 before 2.0.18 allows remote attackers to edit private messages of other users, probably by modifying certain parameters or other inputs...

Microsoft IS error pages information leak

Request variable SERVERNAME controllable by client is used to validate server access...

JBoss application server information leak

Insuficcient request validation allows to obtain server installation, configuration and version information...

Debian DSA-224-1 : canna - buffer overflow and more

Several vulnerabilities have been discovered in canna, a Japanese input system. The Common Vulnerabilities and Exposures CVE project identified the following vulnerabilities : - CAN-2002-1158 BugTraq Id 6351: 'hsj' of Shadow Penguin Security discovered a heap overflow vulnerability in the...

Microsoft Windows Media Services fails to properly validate TCP requests

Overview Microsoft Windows Media Services fails to properly validate TCP requests which could allow a remote, unauthenticated attacker to cause the services to refuse new TCP connections. Description Microsoft Windows Media Services is an optional component that provides the ability to deliver...

Microsoft MSN Messenger fails to properly validate file requests

Overview Microsoft MSN Messenger fails to properly validate file requests which could allow an attacker to view the contents of files on the victim's system. Description Microsoft MSN Messenger is an instant messaging application that allows users to collaborate with friends using text messages,...

Advisory: Incorrect Handling of XSS Protection in ASP.Net

Monday, September 8th, 2003 Background: ---------- As part of Microsoft's attempts to make it easier for application developers to write secure code, Microsoft has added a new feature, named Request Validation, to the ASP.Net 1.1 framework. This feature is provides out of the box protection again...

CVE-2002-1159

Canna 3.6 and earlier does not properly validate requests, which allows remote attackers to cause a denial of service or information leak...

CVE-2002-1159

Canna 3.6 and earlier does not properly validate requests, which allows remote attackers to cause a denial of service or information leak...

Important: Red Hat Security Advisory: Canna security update

The Canna server, used for Japanese character input, has two security vulnerabilities including an exploitable buffer overflow that allows a local user to gain 'bin' user privileges. Updated packages for Red Hat Linux Advanced Server are available. Updated 13 Jan 2003 Added fixed packages for the...

More problems with RADIUS (protocol and implementations)

Hello bugtraq, There are more problems in RADIUS protocol and some of implementations: 1. There is no way RADIUS server can validate Access-Request packet really originated by NAS RADIUS client before and even after, if packet has no User-Password attribute decoding all attributes. It opens a...

iCat Carbo Server File Disclosure Vulnerability

Description iCat Electronic Commerce Suite is an application which enables a user to create and manage web based catalogues. A remote user may retrieve known files on a target system running iCat Electronic Commerce Suite. The Carbo Server component of the Electronic Commerce Suite does not...