4256 matches found
Mephisto blog is vulnerable to XSS
Hello everyone! Current bleeding-edge version of Mephisto blog is vulnerable to XSS. Comment's author name accept javascript code. If admin approves/ rejects comments manually, he have to load all unapproved comments, so it's possible to fetch his session id. Example Add new comment with the...
Wordpress <= v2.1.0
If you're logged in into wordpress as an admin, your comments aren't properly sanitized, thus allowing an XSS to be posted. This can be exploited using XSRF techniques. More info & PoC: http://www.virtuax.be/advisories/Advisory4-20022007.txt...
CVE-2007-1176
Multiple cross-site scripting XSS vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 Gallery Comments pages, 2 Feedback pages, 3 Search Results pages, and 4 the Statistics Log viewer...
CVE-2007-1176
Multiple cross-site scripting XSS vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 Gallery Comments pages, 2 Feedback pages, 3 Search Results pages, and 4 the Statistics Log viewer...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 Gallery Comments pages, 2 Feedback pages, 3 Search Results pages, and 4 the Statistics Log viewer...
CVE-2007-1176
Multiple cross-site scripting XSS vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 Gallery Comments pages, 2 Feedback pages, 3 Search Results pages, and 4 the Statistics Log viewer...
CVE-2007-1176: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 Gallery Comments pages, 2 Feedback pages, 3 Search Results pages, and 4 the Statistics Log viewer...
Mandrake Linux Security Advisory : kdelibs (MDKSA-2007:031)
Konqueror 3.5.5 does not properly parse HTML comments in title tags, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment, a related issue to CVE-2007-0478. Updated packages have been patch...
Drupal < 4.7.6 (post comments) Remote Command Execution Exploit v2
No description provided by source. !/usr/bin/perl $Id: milw0rmdrupalv4.pl,v 0.2 2007/02/15 13:28:29 str0ke Exp $ milw0rmdrupalv4.pl - Drupal 4.7.6 Remote Command Execution Exploit Copyright c 2007 str0ke str0ke!milw0rm.com Description ----------- Previews on comments were not passed through norma...
Sql injection
SQL injection vulnerability in comments.php in LushiNews 1.01 and earlier allows remote authenticated users to inject arbitrary SQL commands via the id parameter...
Unfixed XSS vulnerability at www.lovelyparty.co.uk
Security researcher x2Fusion, has submitted on 02/09/2007 a cross-site-scripting XSS vulnerability affecting www.lovelyparty.co.uk, which at the time of submission ranked 6115330 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/09/2007. It is...
USN-420-1: KDE library vulnerability
Jose Avila III and Robert Tasarz discovered that the KDE HTML library did not correctly parse HTML comments inside the "title" tag. By tricking a Konqueror user into visiting a malicious website, an attacker could bypass cross-site scripting protections...
DEBIAN-CVE-2007-0541
WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain...
CVE-2007-0537
The KDE HTML library kdelibs, as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to...
CVE-2007-0537
The KDE HTML library kdelibs, as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to...
Cross site scripting
The KDE HTML library kdelibs, as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to...
CVE-2007-0537
The KDE HTML library kdelibs, as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to...
CVE-2007-0537: Improper Neutralization of Input During Web Page Generation
The KDE HTML library kdelibs, as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to...
Cross site scripting
WebCore on Apple Mac OS X 10.3.9 and 10.4.10, as used in Safari, does not properly parse HTML comments in TITLE elements, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within an HTML comment...
Safari Improperly Parses HTML Documents & BlogSpot XSS vulnerability
Overview: Safari on occasions may improperly parse the source of an HTML document, which can lead to the execution of html tags within comments. This can become dangerous when input filters allow html tags within comments, as they will get parsed and executed under certain circumstances. Details:...