cURL -- multiple vulnerabilities

The cURL project reports cookie injection for other servers case insensitive password comparison OOB write via unchecked multiplication double-free in curlmaprintf double-free in krb5 code glob parser write/read out of bounds curlgetdate read out of bounds URL unescape heap overflow via integer...

UBUNTU-CVE-2016-8622

The URL percent-encoding decode function in libcurl before 7.51.0 is called curleasyunescape. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get...

DEBIAN-CVE-2016-7167

Multiple integer overflows in the 1 curlescape, 2 curleasyescape, 3 curlunescape, and 4 curleasyunescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow...

UBUNTU-CVE-2016-7167

Multiple integer overflows in the 1 curlescape, 2 curleasyescape, 3 curlunescape, and 4 curleasyunescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow...

PT-2016-7247

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 7.50.3 Description The issue is caused by multiple integer overflows in the curl escape, curl easy escape, curl unescape, and curl easy unescape functions. These functions perform string URL percent escaping and...

cmseasy最新版存储型XSS+代码分析（可绕过xss防护机制）

简要描述： cmseasy 5.5.0.20140605 详细说明： bbs/ajax.php $data = array; $POST'content' = unescape$POST'content'; $data'aid' = isset$POST'aid' ? intval$POST'aid' : exit0; $data'tid' = isset$POST'tid' ? intval$POST'tid' : 0; $data'content' = isset$POST'content' ? $POST'content' : exit0; $data'username' =...

PT-2013-1266

Name of the Vulnerable Software and Affected Versions libmicrohttpd versions prior to 0.9.32 Description The issue in the MHD http unescape function might allow remote attackers to obtain sensitive information or cause a denial of service via unspecified vectors that trigger an out-of-bounds read...

PT-2013-1238

Name of the Vulnerable Software and Affected Versions cURL versions 7.7 through 7.30.0 libcurl versions prior to 7.34.0 Description The issue is related to a heap-based buffer overflow in the curl easy unescape function, which can be exploited by remote attackers to cause a denial of service or...

PT-2012-5247

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 17.0 Thunderbird versions prior to 17.0 SeaMonkey versions prior to 2.14 Description The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and...

科讯 6.x - 7.06 SQL 注射漏洞

简要描述： 详细说明： Author:my5t3ry 转载请注明：t00ls.net 漏洞位于注册页面的\User\Reg\RegAjax.asp 中的24 - 46行 和 254 -270 行 代码如下： Class AjaxCheck Private KS Private Sub ClassInitialize Set KS=New PublicCls End Sub Private Sub ClassTerminate Set KS=Nothing End Sub Public Sub Kesion Select Case KS.S"Action" Case...

Apple Safari 4.0.5 parent.close() (memory corruption) Code Execution

Exploit for windows platform in category remote exploits ==================================================================== Apple Safari 4.0.5 parent.close memory corruption Code Execution ==================================================================== Tested on: Apple Safari 4.0.5 / XP SP...

CVE-2010-0416

Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a URL argument containing a % percent...

CVE-2010-0416

Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a URL argument containing a % percent...

CVE-2010-0416: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a URL argument containing a % percent...

RHEL 4 : HelixPlayer (RHSA-2010:0094)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0094 advisory. - HelixPlayer / RealPlayer: GIF file heap overflow CVE-2009-4242 - HelixPlayer / RealPlayer: compressed GIF heap overflow CVE-2009-4245 -...

RealPlayer: URL unescape buffer overflow

Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a URL argument containing a % percent...

BaoFeng ActiveX OnBeforeVideoDownload() Remote BOF Exploit

Exploit for windows platform in category remote exploits ========================================================== BaoFeng ActiveX OnBeforeVideoDownload Remote BOF Exploit ========================================================== BaoFeng mps.dll Remote Code Execution Exploit By: MITBOY Download...

CVE-2008-0630

Buffer overflow in url.c in MPlayer 1.0rc2 and SVN before r25823 allows remote attackers to execute arbitrary code via a crafted URL that prevents the IPv6 parsing code from setting a pointer to NULL, which causes the buffer to be reused by the unescape code...

DEBIAN-CVE-2008-0630

Buffer overflow in url.c in MPlayer 1.0rc2 and SVN before r25823 allows remote attackers to execute arbitrary code via a crafted URL that prevents the IPv6 parsing code from setting a pointer to NULL, which causes the buffer to be reused by the unescape code...

CVE-2008-0630

Buffer overflow in url.c in MPlayer 1.0rc2 and SVN before r25823 allows remote attackers to execute arbitrary code via a crafted URL that prevents the IPv6 parsing code from setting a pointer to NULL, which causes the buffer to be reused by the unescape code...