Airlock WAF 4.2.4 Overlong UTF-8 Sequence Bypass

No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20120618-1 ======================================================================= title: Airlock WAF overlong UTF-8 sequence bypass product: Airlock vulnerable version: = 4.2.4 without hotfix HF4213 fixed version:...

Inout Ad server Ultimate Shell Upload Vulnerabilty

No description provided by source. ============================================================== Inout Ad server Ultimate -- Shell upload Vulnerabilty ============================================================== Name : Inout Ad server Ultimate Shell upload Vulnerabilty Date : july 9,2010...

OpenSSL and Breaking UTF-8 Change (fixed in Node v0.8.27 and v0.10.29)

OpenSSL and Breaking UTF-8 Change fixed in Node v0.8.27 and v0.10.29 Today we are releasing new versions of Node: node-v0.8.27 node-v0.10.29 First and foremost these releases address the current OpenSSL vulnerability CVE-2014-0224, for both 0.8 and 0.10 we've upgraded the version of the bundled...

openSUSE Security Update : pidgin (openSUSE-SU-2012:0905-1)

Changes in pidgin : - Fixing bnc752275, CVE-2012-1178: Pidgin fails to verify the text's utf-8 encoding %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-432. The text description ...

openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0466-1)

Update to 19.0.1079 Security Fixes bnc754456 : - High CVE-2011-3050: Use-after-free with first-letter handling - High CVE-2011-3045: libpng integer issue from upstream - High CVE-2011-3051: Use-after-free in CSS cross-fade handling - High CVE-2011-3052: Memory corruption in WebGL canvas handling...

openSUSE Security Update : pidgin (openSUSE-2012-29)

pidgin was updated to version 2.10.1 + AIM and ICQ : - Fix remotely-triggerable crashes by validating strings in a few messages related to buddy list management bnc736147, CVE-2011-4601. + Bonjour : - IPv6 fixes + Gadu-Gadu : - Fix problems linking against GnuTLS. + IRC : - Fix a memory leak when...

openSUSE Security Update : boost (openSUSE-SU-2013:1523-1)

This boost update fixes a UTF validation problem. - Apply boost-localeutf.patch to fix a vulnerability in the utf handling of boost:locale bnc801991, CVE-2013-0252 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

openSUSE Security Update : python3 (openSUSE-SU-2012:0861-1)

python3 was fixed for : - Fix bnc758993 - CVE-2012-2135: python3 utf-16 decoder unicodedecodecallerrorhandler alignedend is not updated %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

74cms 最新版 注入8-9

简要描述： 骑士PHP人才系统：74cms V3.4.20140530 详细说明： GBK 2字节一汉字 UTF8 三字节 一汉字。 74cms 在读取数据库的时候 charactersetclient=binary 这样没办法来直接宽字节来注入了。 得找一些转换编码的地方。 錦 从UTF8 转成 GBK之后成了 %e5%5c 74cms对GET POST COOKIE …… 都做了addslashes 所以' 转义后为' -%5C %e5%5c%5c' 两个\ 则单引号出来 再看看74cms的全局过滤 function removexss$string $string =...

Wireshark v1.11.3 - The world’s foremost network protocol analyzer

Wireshark is the world’s foremost network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It is the de facto and often de jure standard across many industries and educational institutions. Wireshark development thrives thanks to the...

Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote Command Injection

Arabic Prawn Gem for Ruby contains a flaw in the lib/stringutfsupport.rb file. The issue is due to the program failing to sanitize user input. This may allow a remote attacker to inject arbitrary commands. "lib/stringutfsupport.rb" in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to...

程氏舞曲CMS最新php版本多处sql注入漏洞

简要描述： 操蛋捏。 详细说明： 昨天刚下载的，2.16号更新的版本。 第一处在管理后台：https://images.seebug.org/upload/app/controllers/admin/news.php第66行 public function so $key = $this-input-get'key';//使用get方式获取相关参数，没做处理 $user = $this-input-get'user'; $cid = $this-input-get'cid'; $page = $this-input-get'page'; ifempty$page $page=1;...

Design/Logic Flaw

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service infinite loop via vectors related to a crafted UTF-8 and a...

CVE-2011-4610

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service infinite loop via vectors related to a crafted UTF-8 and a...

CVE-2012-6152

CVE-2012-6152 affects Pidgin’s Yahoo! protocol plugin (libpurple) before 2.10.8. The vulnerability arises from improper validation of UTF-8 data, enabling a remote attacker to crash the application (DoS) via crafted byte sequences. Affected: Pidgin/libpurple up to version 2.10.7.x; remediator: up...

CVE-2012-6152

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service application crash via crafted byte sequences...

pidgin: DoS when decoding non-UTF-8 strings in Yahoo protocol plugin

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service application crash via crafted byte sequences...

CVE-2012-6152

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service application crash via crafted byte sequences...

CVE-2013-4884

Cross-site scripting XSS vulnerability in McAfee SuperScan 4.0 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded sequences in a server response, which is not properly handled in the SuperScan HTML report...

CVE-2013-2031

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox...