3143 matches found
PHP 5.x < 5.3.4 Improper Input Validation Vulnerability
PHP is prone to an improper input validation vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; ifdescripti...
ACTCMS system exploit-a vulnerability warning-the black bar safety net
ACTCMS is a fully open source program, there are UTF-8 and GB2132 two encoded version, supports ACCESS and MSSQL two databases. Preface: Two days ago in the Group Chat when listening to the group of friends have to say met a ACTCMS system, you and ACTCMS more ripped in a few words, when idle no...
OpenLDAP Modrdn RDN UTF-8 String Code Execution (CVE-2010-0211)
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol LDAP service. On a default installation, the OpenLDAP server uses TCP port 389 for communication. A remote code execution vulnerability has been reported in OpenLDAP. The vulnerability is due to a memory...
Mozilla Foundation Security Advisory 2010-61
Mozilla Foundation Security Advisory 2010-61 Title: UTF-7 XSS by overriding document charset using object type attribute Impact: High Announced: September 7, 2010 Reporter: David Huang, Collin Jackson Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.9 Firefox 3.5.12 Thunderbird 3.1...
Cross site scripting
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting XSS...
CVE-2010-2768
CVE-2010-2768 affects Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). Root cause: Object tag type attribute not properly restricted when setting a document charset, enabling UTF-7 encoded payloads to bypass X...
CVE-2010-2768
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting XSS...
FreeBSD : mozilla -- multiple vulnerabilities (4a21ce2c-bb13-11df-8e32-000f20797ede)
The Mozilla Project reports : MFSA 2010-49 Miscellaneous memory safety hazards rv:1.9.2.9/ 1.9.1.12 MFSA 2010-50 Frameset integer overflow vulnerability MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array MFSA 2010-52 Windows XP DLL loading vulnerability MFSA 2010-53 Heap buffer...
Mozilla UTF-7 XSS by overriding document charset using <object> type attribute (MFSA 2010-61)
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting XSS...
Mozilla UTF-7 XSS by overriding document charset using <object> type attribute (MFSA 2010-61)
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting XSS...
UTF-7 XSS by overriding document charset using <object> type attribute — Mozilla
Security researchers David Huang and Collin Jackson of Carnegie Mellon University CyLab Silicon Valley campus reported that the type attribute of an tag can override the charset of a framed HTML document, even when the document is included across origins. A page could be constructed containing su...
CVE-2010-2768
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting XSS...
Tomcat UTF-8 Directory Traversal Vulnerability
This module tests whether a directory traversal vulnerability is present in versions of Apache Tomcat 4.1.0 - 4.1.37, 5.5.0 - 5.5.26 and 6.0.0 - 6.0.16 under specific and non-default installations. The connector must have allowLinking set to true and URIEncoding set to UTF-8. Furthermore, the...
FreeBSD : ruby -- UTF-7 encoding XSS vulnerability in WEBrick (34e0316a-aa91-11df-8c2e-001517289bf8)
The official ruby site reports : WEBrick have had a cross-site scripting vulnerability that allows an attacker to inject arbitrary script or HTML via a crafted URI. This does not affect user agents that strictly implement HTTP/1.1, however, some user agents do not. %NASLMINLEVEL 70300 C Tenable...
ruby -- UTF-7 encoding XSS vulnerability in WEBrick
The official ruby site reports: WEBrick have had a cross-site scripting vulnerability that allows an attacker to inject arbitrary script or HTML via a crafted URI. This does not affect user agents that strictly implement HTTP/1.1, however, some user agents do not...
Wizmall 6.4 Cross Site Request Forgery
Exploit Title: wizmall 6.4 CSRF Vulnerabilities Date: 08/10/2010 Author: pyw1414 Software Link: http://www.shop-wiz.com/board/main/view/root/wizmall01/159/0 Version: 6.4 UTF-8 For php Tested on: XP SP3 -= CSRF Exploit - Change Admin ID/PW =- Wizmall 6.4 UTF-8 For php CSRF Vulnerabilities - Change...
wizmall 6.4 - Cross-Site Request Forgery
Exploit Title: wizmall 6.4 CSRF Vulnerabilities Date: 08/10/2010 Author: pyw1414 Software Link: http://www.shop-wiz.com/board/main/view/root/wizmall01/159/0 Version: 6.4 UTF-8 For php Tested on: XP SP3 -= CSRF Exploit - Change Admin ID/PW =- Wizmall 6.4 UTF-8 For php CSRF Vulnerabilities - Change...
wizmall 6.4 CSRF Vulnerabilities
Exploit for php platform in category web applications ================================ wizmall 6.4 CSRF Vulnerabilities ================================ Author: pyw1414 Software Link: http://www.shop-wiz.com/board/main/view/root/wizmall01/159/0 Version: 6.4 UTF-8 For php Tested on: XP SP3 -= CSRF...
perl: heap corruption by regular expressions with utf8 characters
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service memory corruption and crash via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems...
mod_proxy_ftp XSS
modproxyftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting XSS attacks using UTF-7 encoding...