941 matches found
CVE-2007-3656
Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI, which allows remote attackers to obtain sensitive information, poison the browser cache, and possibly enable further attack vectors via 1 HTTP 302 redirect controls, 2...
CVE-2007-3576
Microsoft Internet Explorer 6 executes web script from URIs of arbitrary scheme names ending with the "script" character sequence, using the 1 vbscript: handler for scheme names with 7 through 9 characters, and the 2 javascript: handler for scheme names with 10 or more characters, which might all...
Sun Board Multiple Remote File Include Vulnerabilities
Sun 是容易发生多个远程文件包括脆弱漏洞,因为它未能充分净化用户提供数据. 利用这些问题可能使攻击者妥协的应用和基本制度; 其他的攻击也是可能的. 这些问题影响版本1.00.00 alpha; 其它版本也可能会受到影响. Kim Kyoung Min Sun Board 1.00.00 alpha http://playsb.com/ 暂无 Attackers can use a browser to exploit these issues. The following proof-of-concept URIs are available:...
CVE-2007-1878
Cross-zone scripting vulnerability in the DOM templates domplates used by the console.log function in the Firebug extension before 1.03 for Mozilla Firefox allows remote attackers to bypass zone restrictions, read arbitrary file:// URIs, or execute arbitrary code in the browser chrome, as...
Inkscape multiple security vulnerabilities
Format string vulnerability in URIs displaying, security problems with Jabber protocol...
CVE-2006-7165
IBM WebSphere Application Server WAS 5.0 through 5.1.1.0 allows remote attackers to obtain JSP source code and other sensitive information via certain "special URIs."...
security flaw
Cross-zone vulnerability in Mozilla Firefox 1.5.0.9 considers blocked popups to have an internal zone origin, which allows user-assisted remote attackers to cross zone restrictions and read arbitrary file:// URIs by convincing a user to show a blocked popup...
security flaw
Cross-zone vulnerability in Mozilla Firefox 1.5.0.9 considers blocked popups to have an internal zone origin, which allows user-assisted remote attackers to cross zone restrictions and read arbitrary file:// URIs by convincing a user to show a blocked popup...
Mandrake Linux Security Advisory : spamassassin (MDKSA-2007:049)
A bug in the way that SpamAssassin processes HTML emails containing URIs was discovered in versions 3.1.x. A carefully crafted mail message could make SpamAssassin consume significant amounts of CPU resources that could delay or prevent the delivery of mail if a number of these messages were sent...
CVE-2007-0800
Cross-zone vulnerability in Mozilla Firefox 1.5.0.9 considers blocked popups to have an internal zone origin, which allows user-assisted remote attackers to cross zone restrictions and read arbitrary file:// URIs by convincing a user to show a blocked popup...
EasyMoblog 0.5.1 - Multiple Input Validation Vulnerabilities
source: https://www.securityfocus.com/bid/22369/info EasyMoblog is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow a...
DSA-1240-1 links2
Bulletin has no description...
Debian DSA-1226-1 : links - insufficient escaping
Teemu Salmela discovered that the links character mode web browser performs insufficient sanitising of smb:// URIs, which might lead to the execution of arbitrary shell commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
DSA-1226-1 links
Bulletin has no description...
Skype for Mac contains a format string error in the handling of URI arguments
Overview Skype for Mac contains a format string vulnerability in the handling of URIs, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Skype software provides telephone service over IP networks. There is a format string vulnerabilit...
CVE-2006-3231
IBM WebSphere Application Server (WAS) prior to 6.0.2.11 is affected when fileServingEnabled is true. An attacker can remotely obtain JSP source code and other sensitive information through URIs with special characters. The impact is partial confidentiality. Remediation: upgrade WAS to version 6....
Novell eDirectory 8.8 NDS Server Buffer Overflow Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell eDirectory. Exploitation does not require authentication. The specific flaw exists within the iMonitor NDS Server, which by default exposes an HTTP interface on TCP port 8028 and an HTTPS...
USN-245-1: KDE library vulnerability
Maksim Orlovich discovered that kjs, the Javascript interpreter engine used by Konqueror and other parts of KDE, did not sufficiently verify the validity of UTF-8 encoded URIs. Specially crafted URIs could trigger a buffer overflow. By tricking an user into visiting a web site with malicious...