Other nomination
Variable Width Encoding
Reports Cheng Peng Su's variable-width encoding filter evasion: a lead byte in the range 192-253 or 255 combines with a following double quote into a single multibyte character, so the quote stops terminating an attribute and the attacker stays inside the tag. Affects UTF-8, GB2312, GB18030, BIG5, EUC-KR, EUC-JP and SHIFT_JIS in Internet Explorer.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.