CVE-2007-5222

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

PT-2007-6305 · Maxdev · Maxdev Md-Pro

Name of the Vulnerable Software and Affected Versions: MAXdev MDPro MD-Pro version 1.0.76 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by including a specific substring in the Referer HTTP header. The Firefox ID= substring is used to inject SQ...

MD-Pro 1.0.76 - SQL Injection

!/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author = "undefined1"; my $settings = "magicquotesruntime = off, mysql = 4.1.0"; $| = 1; print ":: $app $type - by $author ::\n\n\n"; my $url = shift || usage; if$url = m/^?:http://./ $url = $1;...

asp,PHP and. net forge HTTP-REFERER method and forgery preventing REFERER-bug warning-the black bar safety net

HTTP-REFERER this variable has been increasingly unreliable, and completely is what can be forged out of the stuff. The following is the forged method: ASP/Visual Basic code dim http set http=server. createobject"MSXML2. XMLHTTP" '//MSXML2. serverXMLHTTP also can Http. open "GET",url,false Http...

Zyxel Zywall crossite request forgery

Referer is not chacked on data submission...

Adobe Flash Player fails to properly validate HTTP Referers

Overview The Adobe Flash Player fails to properly validate HTTP Referers. This may allow an attacker to conduct cross-site request forgery attacks. Description Adobe Flash Player is a player for the Flash media format and enables frame-based animations with sound to be viewed within a web browser...

CVE-2007-3686

CRLF injection vulnerability in db.php in Unobtrusive Ajax Star Rating Bar before 1.2.0 allows remote attackers to inject arbitrary HTTP headers and data via CRLF sequences in the HTTPREFERER parameter...

CVE-2007-3457

Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers, which might allow remote attackers to conduct a CSRF attack via a crafted SWF file...

CVE-2007-3457

Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers, which might allow remote attackers to conduct a CSRF attack via a crafted SWF file...

Cross site request forgery (csrf)

Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers, which might allow remote attackers to conduct a CSRF attack via a crafted SWF file...

CVE-2007-3457

Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers, which might allow remote attackers to conduct a CSRF attack via a crafted SWF file...

JVN#72595280 Flash Player allows to send arbitrary Referer headers

Adobe Flash Player is a multimedia and application browser plugin for viewing Adobe Flash contents. Flash Player contains a vulnerability allowing to send arbitrary Referer headers. Impact As a flash file swf can send an arbitrary Referer header and Flash Player cannot properly validate Referer...

Flash Player Multiple Vulnerabilities (APSB07-12)

According to its version number, the instance of Flash Player on the remote Windows host could allow for arbitrary code execution by means of a malicious SWF file. In addition, it may also fail to sufficiently validate the HTTP Referer header, which may aid in cross-site request forgery attacks...

WordPress自动统计模块Referer字段HTML注入漏洞

WordPress是一款基于WEB的BLOG系统。 基于WordPress上的自动统计模块不正确处理用户提交的输入，远程攻击者可以利用漏洞进行HTML注入攻击，获得敏感信息。 问题是由于不正确过滤用户生成的HTTP头字段中的Referer参数数据，提交恶意的HTTP数据，并诱使用户访问，可导致获得目标用户敏感信息。 Skeltoac Automattic Stats 1.0 可联系供应商获得补丁信息： http://wordpress.org/extend/plugins/stats/ GET http://www.somewpblog.com/ HTTP/1.1...

Cross site scripting

Cross-site scripting XSS vulnerability in the skeltoac stats Automattic Stats 1.0 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer field...

CVE-2007-3288

Cross-site scripting XSS vulnerability in the skeltoac stats Automattic Stats 1.0 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer field...

WordPress Automattic Stats Plugin <= 1.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the HTTP Referer field. Solution Update the plugin...

CVE-2007-3243

Cross-site scripting XSS vulnerability in bb-login.php in bbPress 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the re parameter. NOTE: exploitation may require forcing the client to send a certain Referer header...

Cross site scripting

Cross-site scripting XSS vulnerability in bb-login.php in bbPress 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the re parameter. NOTE: exploitation may require forcing the client to send a certain Referer header...

CVE-2007-3243

CVE-2007-3243 affects bbPress 0.8.1 via bb-login.php. The XSS vulnerability allows remote attackers to inject arbitrary script/HTML through the re parameter; exploitation may hinge on a specific Referer header being sent by the client. The cited sources (NVD entry) describe the issue and impact a...