CVE-2008-0599

The initrequestinfo function in sapi/cgi/cgimain.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATHTRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI...

CVE-2008-0599

CVE-2008-0599 affects PHP before 5.2.6. The vulnerability is in init_request_info within sapi/cgi/cgi_main.c where operator precedence mishandles the length calculation of PATH_TRANSLATED, enabling remote attackers to execute arbitrary code via a crafted URI. CVSSv3 base score 9.8 (CRITICAL; AV:N...

CVE-2008-0599

The initrequestinfo function in sapi/cgi/cgimain.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATHTRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI...

CVE-2008-0599

The initrequestinfo function in sapi/cgi/cgimain.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATHTRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI. Recent assessments: sulinhyo at March 28, 2022 7:35a...

Microsoft IE 7 popup window address bar URI spoofing vulnerability-vulnerability warning-the black bar safety net

| Affected versions: Microsoft Internet Explorer 7.0 --- Description: BUGTRAQ ID: 2 8 4 9 8 Internet Explorer is Microsoft's release of the very popular WEB browser. If the user use IE to visit a malicious Web page while the pop-up window's address bar may be any address and the window theme to a...

Buffer overflow

Buffer overflow in Novell GroupWise 7 allows remote attackers to cause a denial of service or execute arbitrary code via a long argument in a mailto: URI...

DSquare Exploit Pack: D2SEC_GW7

Name| d2secgw7 ---|--- CVE| CVE-2008-2069 Exploit Pack| D2ExploitPack Description| Novell GroupWise mailto URI Handler Stack Overflow Notes|...

CVE-2008-2069

CVE-2008-2069 affects Novell GroupWise 7, where a buffer overflow in the mailto: URI handler allows remote attackers to cause a denial of service or execute arbitrary code. The vulnerability is triggered by a long argument in a mailto: URI, with public references noting exploitation in exploit pa...

Directory traversal

Directory traversal vulnerability in Chilek Content Management System aka ChiCoMaS 2.0.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the operation parameter to the default URI under install/...

Novell GroupWise mailto URI处理器缓冲区溢出漏洞

BUGTRAQ ID: 28969 Novell GroupWise是一款跨平台协作软件。 GroupWise处理超长的mailto URL时存在漏洞，如果用户将GroupWise设置为默认的邮件客户端的话，则跟随了超长mailto URI就可以触发缓冲区溢出，导致执行任意指令。 Novell Groupwise 7 Novell ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://support.novell.com/security-alerts...

SugarCRM Community Edition 4.5.1/5.0.0 File Disclosure Vulnerability

No description provided by source. Name SugarCRM – Local File Disclosure SugarCRM http://www.sugarcrm.com/docs/ReleaseNotes/OpenSourceReleaseNotes4.5.1j/ Advisories SugarReleaseNotes4.5.1j.2.6.html Bug 20522 http://dl.sugarforge.org/sugarcrm/SugarCE5.0Latest/SugarCE5.0.0/...

Novell Groupwise buffer overflow

Buffer overflow on mailto: URI parsing...

Lotus Expeditor code execution

cai: URI handler allows code exectuion from any SMB share...

Lotus expeditor rcplauncher uri handler vulnerability

Hello Lotus expeditor rcplauncher registers a cai: uri handler. This handler executes "D:Program FilesIBMLotusSymphonyframeworkrcprcplauncher.exe" -config notes -com.ibm.rcp.portal.app.uiopenCA "1" the rcplauncher process accepts various arguments which can be abused to execute arbitrary code. Th...

Design/Logic Flaw

Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Symphony and possibly other products, allows remote attackers to execute arbitrary code by injecting a -launcher option via a cai: URI, as demonstrat...

CVE-2008-1965

IBM Lotus Expeditor's cai: URI handler in rcplauncher (used by Lotus Expeditor Client for Desktop 6.1.1/6.1.2 and Lotus Symphony) is vulnerable: a crafted cai: URI can inject -launcher to rcplauncher.exe, enabling remote code execution with the user's privileges. The attack relies on loading a sp...

CVE-2008-1965

Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Symphony and possibly other products, allows remote attackers to execute arbitrary code by injecting a -launcher option via a cai: URI, as demonstrat...

RSA认证代理URI重新定向漏洞

BUGTRAQ ID: 28907 RSA认证代理软件是非常流行的动态认证工具，可控制对公司网络、基于Web的应用和操作系统的访问。 RSA认证代理处理URL参数时存在输入验证漏洞，远程攻击者可能利用此漏洞执行钓鱼攻击。 当RSA认证代理访问特制的URL时，服务器端脚本/WebID/IISWebAgentIF.dll只过滤了http://和https:// 协议的url参数但没有过滤FTP或Gopher协议的URL参数。如果攻击者向允许匿名连接的FTP服务器上传了伪造的登录页面的话，就可能将用户重新定向至任意页面，这有助于攻击者发动网络钓鱼攻击。 RSA Security RSA...

ProCheckUp Security Advisory 2007.43

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR07-43: Cross-domain redirect on RSA Authentication Agent Vulnerability found: 5th December 2007 Vendor informed: 13th December 2007 Severity: Medium-low Successfully tested on: RSA Authentication Agent 5.3.0.258 for Web for Internet Information...

lotus-exec.txt

Hello, I have found that the lotus expeditor rcplauncher as installed by lotus symphony and possibly other products, registers a cai: uri handler. This handler executes "D:\Program Files\IBM\Lotus\Symphony\framework\rcp\rcplauncher.exe" -config notes -com.ibm.rcp.portal.app.uiopenCA "%1" the...