CVE-2007-3656

Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI, which allows remote attackers to obtain sensitive information, poison the browser cache, and possibly enable further attack vectors via 1 HTTP 302 redirect controls, 2...

CVE-2007-3670

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a 1 FirefoxURL or 2 FirefoxHTM...

Design/Logic Flaw

Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI, which allows remote attackers to obtain sensitive information, poison the browser cache, and possibly enable further attack vectors via 1 HTTP 302 redirect controls, 2...

Cross site scripting

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a 1 FirefoxURL or 2 FirefoxHTM...

CVE-2007-3656

Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI, which allows remote attackers to obtain sensitive information, poison the browser cache, and possibly enable further attack vectors via 1 HTTP 302 redirect controls, 2...

CVE-2007-3670

CVE-2007-3670 describes an argument-injection vulnerability where Internet Explorer could pass malicious parameters to registered Firefox handlers (FirefoxURL/FirefoxHTML) on Windows, enabling cross-browser scripting and potential remote code execution by exploiting the unescaped URL argument whe...

CVE-2007-3656

Mozilla Firefox 1.8.x and earlier versions are affected by CVE-2007-3656 due to not performing a security zone check for wyciwyg URIs. The issue allows a remote attacker to obtain sensitive information, potentially poison the browser cache, and may enable further attack vectors via HTTP 302 redir...

Microsoft Internet Explorer and Mozilla Firefox - URI Handler Command Injection

Microsoft Internet Explorer and Mozilla Firefox - URI Handler Command Injection source: https://www.securityfocus.com/bid/24837/info Microsoft Internet Explorer, Mozilla Firefox and Netscape Navigator are prone to a vulnerability that lets attackers inject commands through the 'firefoxurl' and...

TippingPoint IPS - Unicode Character Detection Bypass

TippingPoint IPS - Unicode Character Detection Bypass source: https://www.securityfocus.com/bid/24855/info TippingPoint IPS is prone to a detection-bypass vulnerability because the appliance fails to properly handle Unicode characters. A successful exploit of this issue may allow an attacker to...

TippingPoint IPS - Unicode Character Detection Bypass

source: https://www.securityfocus.com/bid/24855/info TippingPoint IPS is prone to a detection-bypass vulnerability because the appliance fails to properly handle Unicode characters. A successful exploit of this issue may allow an attacker to bypass the filter and detection system of vulnerable...

CVE-2007-3615

Internet Communication Manager aka ICMAN.exe or ICM in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service process crash via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web...

CVE-2005-4852

The CVE describes a vulnerability in eZ Publish core (siteaccess URIMatching) affecting versions 3.5–3.8 prior to 20050812, where all non-alphanumeric URI characters are replaced with underscores. This allows remote attackers to bypass access restrictions by crafting URIs such as /admin:de, which...

Authentication flaw

Microsoft Internet Explorer 6 executes web script from URIs of arbitrary scheme names ending with the "script" character sequence, using the 1 vbscript: handler for scheme names with 7 through 9 characters, and the 2 javascript: handler for scheme names with 10 or more characters, which might all...

Internet Communication Manager Denial Of Service Attack

======= Summary ======= Name: Internet Communication Manager Denial Of Service Attack Release Date: 5 July 2007 Reference: NGS00484 Discover: Mark Litchfield [email protected] Vendor: SAP Vendor Reference: SECRES-287 Systems Affected: Confirmed on Windows unconfirmed on NIX Risk: High Status:...

SAP Internet Communication Manager DoS

DoS on 264 bytes long URI if Web caching is used...

KVIrc irc:// URI处理器远程命令注入漏洞

BUGTRAQ ID: 24652 CVECAN ID: CVE-2007-2951 KVIrc是一款免费的可移植IRC客户端。 KVIrc客户端在处理“irc://”协议串时存在漏洞，远程攻击者可能利用此漏洞在用户机器上执行命令。 KVIrc客户端的src/kvirc/kernel/kviircurl.cpp文件中的parseIrcUrl函数在为KVIrc的内部脚本系统构建命令时没有正确过滤部分URI，如果用户受骗打开了特制的irc://或类似的URI（如irc6://）的话，就会导致注入并执行KVIrc脚本系统命令。成功攻击要求KVIrc是irc://或类似URI的默认处理器。...

CVE-2007-3486

Cross-site scripting XSS vulnerability in AltaVista search engine allows remote attackers to inject arbitrary web script or HTML via the text parameter to the default URI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Yandex.Server allow remote attackers to inject arbitrary web script or HTML via the 1 query or 2 within parameter to the default URI...

Linksys WAG54GS 1.0.6 (Wireless-G ADSL Gateway) - setup.cgi Cross-Site Scripting

Linksys WAG54GS 1.0.6 Wireless-G ADSL Gateway - setup.cgi Cross-Site Scripting source: https://www.securityfocus.com/bid/24682/info Linksys Wireless-G ADSL Gateway is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input...

CVE-2007-2951

The parseIrcUrl function in src/kvirc/kernel/kviircurl.cpp in KVIrc 3.2.0 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an 1 irc:// or 2 irc6:// URI...