CVE-2007-5415

CVE-2007-5415 describes an XSS in Mozilla Firefox 2.0 where UTF-7 document content rendered in UTF-7 allows remote attackers to inject arbitrary script/HTML via a gopher: URI using '/' to delimit a literal string within an XSS sequence. A related issue is CVE-2007-5414 (single-quote delimiter). T...

tomcat examples jsp XSS

Multiple cross-site scripting XSS vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via...

CVE-2007-3896

The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe...

Design/Logic Flaw

The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe...

CVE-2007-3896

The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe...

Microsoft Windows URI处理器命令执行漏洞

Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Windows不正确处理URI中指定的协议，远程攻击者可以利用漏洞以应用程序权限执行任意命令。 URI是用于识别位置，资源或协议的字符串，Microsoft Windows会通过注册的协议处理器来解析URI判断相关的应用程序。多种Windows应用程序类型如WEB浏览器和EMAIL客户端依靠Microsoft Windows来判断适当的应用程序来处理一个特定的URI。 Internet Explorer 7更改了Microsoft...

Cross site scripting

Cross-site scripting XSS vulnerability in Google Mini Search Appliance 3.4.14 allows remote attackers to inject arbitrary web script or HTML via the ie parameter to the /search URI...

CVE-2007-5255

Cross-site scripting XSS vulnerability in Google Mini Search Appliance 3.4.14 allows remote attackers to inject arbitrary web script or HTML via the ie parameter to the /search URI...

CVE-2007-5255

Cross-site scripting XSS vulnerability in Google Mini Search Appliance 3.4.14 allows remote attackers to inject arbitrary web script or HTML via the ie parameter to the /search URI...

urihandlexp.txt

Hello, the URI handling problem on Windows XP systems with IE 7 installed hits a lot of applications, not only Firefox and mIRC -- namely Skype, Acrobat Reader, Miranda, Netscape. To recap: with the installation of IE 7 Microsoft changes the handling of URLs that are passed to the operating syste...

Microsoft Windows URI Handler Command Execution Vulnerability

Description Microsoft Windows XP and Server 2003 with Internet Explorer 7 is prone to a command-execution vulnerability because it fails to properly sanitize input. Successfully exploiting this issue allows remote attackers to execute arbitrary commands in the context of users that follow malicio...

Microsoft Windows - URI Handler Command Execution

source: https://www.securityfocus.com/bid/25945/info Microsoft Windows XP and Server 2003 with Internet Explorer 7 is prone to a command-execution vulnerability because it fails to properly sanitize input. Successfully exploiting this issue allows remote attackers to execute arbitrary commands in...

Apple iPhone Safari浏览器跨域URI泄露漏洞

BUGTRAQ ID: 25859 CVECAN ID: CVE-2007-3756 Apple iPhone是苹果最新发布的智能手机。 iPhone中内嵌的Safari浏览器在网页读取处理上存在漏洞，恶意网站可能利用此漏洞获取用户网络浏览相关的信息。 iPhone中内嵌的Safari浏览器允许网页读取当前在父窗口中所浏览的URL。如果用户受骗访问了恶意网页的话，攻击者就可以获得非相关页面的URL。 Apple iPhone 1.0.1 Apple iPhone 1 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Design/Logic Flaw

JSPWiki 2.4.103 and 2.5.139-beta allows remote attackers to obtain sensitive information full path via an invalid integer in the version parameter to the default URI under attach/Main/...

Second Life URI处理器敏感信息泄露漏洞

Second Life是一种基于网络的虚拟现实游戏。 Second Life安装的URI处理器实现机制上存在漏洞，远程攻击者可能利用此漏洞通过诱使用户访问恶意网页获取用户的敏感信息。 SecondLife注册的"secondlife://" URI处理器允许网站指定任意参数调用它，比如用于认证的"-autologin"和"-loginuri"参数，这样如果用户访问了带有恶意命令的网页，客户端会向发生命令的网页发送用户名和口令HASH，从而导致用户Second Life相关的敏感信息泄露。 Linden Research, Inc. Second Life 1.x...

CVE-2007-4958

Multiple cross-site scripting XSS vulnerabilities in TinyWebGallery TWG 1.6.3.4 allow remote attackers to inject arbitrary web script or HTML via the URI for 1 index.php, 2 iframes/ilogin.php, and 3 iframes/itoptags.php. NOTE: the provenance of this information is unknown; the details are obtaine...

Cross site scripting

Cross-site scripting XSS vulnerability in catalogproductswithimages.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in TinyWebGallery TWG 1.6.3.4 allow remote attackers to inject arbitrary web script or HTML via the URI for 1 index.php, 2 iframes/ilogin.php, and 3 iframes/itoptags.php. NOTE: the provenance of this information is unknown; the details are obtaine...

CVE-2007-4959

CVE-2007-4959 : Cross-site scripting (XSS) in osCMax 2.0.0-RC3-0-1, specifically in catalog_products_with_images.php, allows remote attackers to inject arbitrary web script or HTML via the URI. The description and connected sources confirm the vulnerable component and vector but do not provide re...

CVE-2007-4958

Multiple cross-site scripting XSS vulnerabilities in TinyWebGallery TWG 1.6.3.4 allow remote attackers to inject arbitrary web script or HTML via the URI for 1 index.php, 2 iframes/ilogin.php, and 3 iframes/itoptags.php. NOTE: the provenance of this information is unknown; the details are obtaine...