3106 matches found
IIS decodes filenames superfluously after applying security checks
Overview Microsoft IIS decodes filenames after applying security checks, allowing an attacker to execute commands. Description To accomodate complex URIs, RFC 2396 specifies a means to encode arbitrary octets using hexadecimal characters and the percent sign %. Quoting from RFC 2396: An escaped...
yabb.txt
YaBB 9.1.2000 Multiple Vulnerabilities + Advisory by pestilence www.synnergy.net |===============================================| Affected program: YABB 9.1.2000 previous ? System : Linux, UNIX, Windows Problem : Problem located in all scripts that handle files. Discovery :...
YaBB 1.9.2000 Vulnerabilitie
YaBB 9.1.2000 Multiple Vulnerabilities + Advisory by pestilence www.synnergy.net |===============================================| Affected program: YABB 9.1.2000 previous ? System : Linux, UNIX, Windows Problem : Problem located in all scripts that handle files. Discovery :...
lynx-2.8.x.txt
// This message hasn't been sent to lynx-dev list, as it requires // subscription for sending bugreports. Sorry for that. Since 2.7 releases ?, lynx has mechanisms to avoid spoofed 'special URLs'. It's designed to protect lusers from malicious, internal pseudo-protocols like LYNXDIRED://,...
procmail.overflows.txt
Date: Mon, 5 Apr 1999 02:23:59 -0500 From: Philip Guenther To: [email protected] Subject: Re: SECURITY new version of procmail with security fixes [email protected] writes: A new version of procmail has been released which fixes a couple of buffer overflows and has extr...
