CVE-2007-4595

CVE-2007-4595 is a cross-site scripting vulnerability in Mayaa prior to 1.1.12. The issue arises when a page lacks a charset in a META element or specifies an unrecognized charset, triggering automatic browser charset recognition and improper handling of UTF-7 data, allowing remote attackers to i...

FreeBSD : dokuwiki -- XSS vulnerability in spellchecker backend (cddde37a-39b5-11dc-b3da-001921ab2fa4)

DokuWiki reports : The spellchecker tests the UTF-8 capabilities of the used browser by sending an UTF-8 string to the backend, which will send it back unfiltered. By comparing string length the spellchecker can work around broken implementations. An attacker could construct a form to let users...

CVE-2007-3930

Interpretation conflict between Microsoft Internet Explorer and DocuWiki before 2007-06-26b allows remote attackers to inject arbitrary JavaScript and conduct cross-site scripting XSS attacks when spellchecking UTF-8 encoded messages via the spellutf8test function in lib/exe/spellcheck.php, which...

Cross site scripting

Interpretation conflict between Microsoft Internet Explorer and DocuWiki before 2007-06-26b allows remote attackers to inject arbitrary JavaScript and conduct cross-site scripting XSS attacks when spellchecking UTF-8 encoded messages via the spellutf8test function in lib/exe/spellcheck.php, which...

CVE-2007-3930

Interpretation conflict between Microsoft Internet Explorer and DocuWiki before 2007-06-26b allows remote attackers to inject arbitrary JavaScript and conduct cross-site scripting XSS attacks when spellchecking UTF-8 encoded messages via the spellutf8test function in lib/exe/spellcheck.php, which...

dokuwiki -- XSS vulnerability in spellchecker backend

DokuWiki reports: The spellchecker tests the UTF-8 capabilities of the used browser by sending an UTF-8 string to the backend, which will send it back unfiltered. By comparing string length the spellchecker can work around broken implementations. An attacker could construct a form to let users se...

Heap overflow

Heap-based buffer overflow in Cerulean Studios Trillian 3.x before 3.1.6.0 allows remote attackers to execute arbitrary code via a message sent through the MSN protocol, or possibly other protocols, with a crafted UTF-8 string, which triggers improper memory allocation for word wrapping when a...

CVE-2007-3305

Heap-based buffer overflow in Cerulean Studios Trillian 3.x before 3.1.6.0 allows remote attackers to execute arbitrary code via a message sent through the MSN protocol, or possibly other protocols, with a crafted UTF-8 string, which triggers improper memory allocation for word wrapping when a...

CVE-2007-3305

CVE-2007-3305 concerns Cerulean Studios Trillian 3.x before 3.1.6.0, where a heap-based buffer overflow occurs during UTF-8 handling when word-wrapping a message (buffer size driven by window width). The flaw allows remote attackers to execute arbitrary code via crafted UTF-8 text sent through MS...

CVE-2007-3305

Heap-based buffer overflow in Cerulean Studios Trillian 3.x before 3.1.6.0 allows remote attackers to execute arbitrary code via a message sent through the MSN protocol, or possibly other protocols, with a crafted UTF-8 string, which triggers improper memory allocation for word wrapping when a...

Cerulean Studios Trillian Instant Messenger fails to properly handle "UTF-8" sequences

Overview A vulnerability in Cerulean Studios Trillian Instant Messenger client may lead to execution of arbitrary code. Description Cerulean Studios Trillian Instant Messenger client fails to properly handle specially crafted UTF-8 text. A heap overflow may occur when Trillian receives a messages...

Trillian instant messenger buffer overflow

Invalid processing of UTF-8 text...

Trillian < 3.1.6.0 Multiple Vulnerabilities

The version of Trillian installed on the remote host reportedly is affected by a heap-based buffer overflow issue involving improper handling of UTF-8 sequences when word-wrapping UTF-8 text. A remote attacker may be able to leverage these issues to execute arbitrary code as the current user. C...

Microsoft Outlook Web Access远程脚本注入漏洞（MS07-026）

Outlook Web Access是Microsoft Exchange中用于通过Web浏览器读取和发送邮件的工具。 Outlook Web Access在处理特定的数据编码时存在漏洞，远程攻击者可能利用此漏洞控制用户机器。 Outlook Web Access没有正确地处理某些UTF字符集标签，因此可能未经正确地过滤便显示了基于脚本的附件。如果攻击者发送了带有特制UTF编码邮件附件的话，就可能导致在用户浏览器环境中执行任意代码或读取敏感信息。 Microsoft Exchange Server 2003 SP2 Microsoft Exchange Server 2003 SP1...

Cross site scripting

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an...

Microsoft Exchange Outlook Web Access UTF character set label script injection vulnerability

Overview Microsoft Exchange Outlook Web Access OWA fails to properly handle the UTF character set label, which can allow a remote, unauthenticated attacker to execute script within the security context of the OWA user. Description OWA allows users to access their email accounts on a Microsoft...

CVE-2007-2478

Multiple heap-based buffer overflows in the IRC component in Cerulean Studios Trillian Pro before 3.1.5.1 allow remote attackers to corrupt memory and possibly execute arbitrary code via 1 a URL with a long UTF-8 string, which triggers the overflow when the user highlights it, or 2 a font HTML ta...

Design/Logic Flaw

Cerulean Studios Trillian Pro before 3.1.5.1 allows remote attackers to obtain potentially sensitive information via long CTCP PING messages that contain UTF-8 characters, which generates a malformed response that is not truncated by a newline, which can cause portions of a server message to be...

Heap overflow

Multiple heap-based buffer overflows in the IRC component in Cerulean Studios Trillian Pro before 3.1.5.1 allow remote attackers to corrupt memory and possibly execute arbitrary code via 1 a URL with a long UTF-8 string, which triggers the overflow when the user highlights it, or 2 a font HTML ta...

CVE-2007-2479

Cerulean Studios Trillian Pro before 3.1.5.1 allows remote attackers to obtain potentially sensitive information via long CTCP PING messages that contain UTF-8 characters, which generates a malformed response that is not truncated by a newline, which can cause portions of a server message to be...