4256 matches found
[Full-disclosure] [DRUPAL-SA-2005-002] Drupal 4.6.2 / 4.5.4 fixes input validation issue
---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2005-002 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2005-002 Date: 2005-jun-29 Security risk: highly critical Impact: system...
drupal -- PHP code execution vulnerabilities
Kuba Zygmunt discovered a flaw in the input validation routines of Drupal's filter mechanism. An attacker could execute arbitrary PHP code on a target site when public comments or postings are allowed...
CVE-2005-1715
CVE-2005-1715 describes a reflected cross-site scripting vulnerability in TOPo 2.2 (version 2.2.178), specifically in index.php. The issue allows remote attackers to inject arbitrary script/HTML via several inputs in the comments section and related fields: (1) m, (2) s, (3) ID, (4) t, and (5) fi...
CVE-2005-1715
Cross-site scripting XSS vulnerability in index.php for TOPo 2.2 2.2.178 allows remote attackers to inject arbitrary web script or HTML via the 1 m, 2 s, 3 ID, or 4 t parameters, or the 5 field name, 6 Your Web field, or 7 email field in the comments section...
CVE-2005-1715: Undefined Security Weakness
Cross-site scripting XSS vulnerability in index.php for TOPo 2.2 2.2.178 allows remote attackers to inject arbitrary web script or HTML via the 1 m, 2 s, 3 ID, or 4 t parameters, or the 5 field name, 6 Your Web field, or 7 email field in the comments section...
CVE-2005-1499
delcomment.php in myBloggie 2.1.1 allows remote attackers to delete arbitrary comments by modifying the commentid parameter...
CVE-2005-1511
PwsPHP 1.2.2 allows remote attackers to bypass authentication and post arbitrary comments via the Pseudo cookie...
CVE-2005-1499
CVE-2005-1499 affects myBloggie 2.1.1 via delcomment.php, where remote attackers can delete arbitrary comments by modifying the comment_id parameter. The NVD notes a CVSSv2 base score of 7.5 (HIGH) with network attack vector, low attack complexity, no authentication required, and partial impact o...
CVE-2005-1511
PwsPHP 1.2.2 allows remote attackers to bypass authentication and post arbitrary comments via the Pseudo cookie...
CVE-2005-1499: Undefined Security Weakness
delcomment.php in myBloggie 2.1.1 allows remote attackers to delete arbitrary comments by modifying the commentid parameter...
CVE-2004-1836: Undefined Security Weakness
SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary SQL via the id parameter of the comments action...
CVE-2004-1949: Undefined Security Weakness
SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via 1 the sif parameter to index.php in the Comments module or 2 timezoneoffset parameter to changeinfo.php in the YourAccount module...
CVE-2005-0461
Unknown vulnerability in NewsBruiser 2.x before 2.6.1 allows remote attackers to "take actions on comments."...
CVE-2005-1140
The connected documents confirm CVE-2005-1140 is an XSS vulnerability in myBloggie 2.1.1 that allows remote attackers to inject arbitrary script/HTML via comments. Affected product: myBloggie 2.1.1. Underlying issue is cross-site scripting in the comments handling. CVSS-derived context from NVD l...
CVE-2005-1140
Cross-site scripting XSS vulnerability in myBloggie 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the comments...
CVE-2005-1140: Undefined Security Weakness
Cross-site scripting XSS vulnerability in myBloggie 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the comments...
myBloggie 2.1.1
myBloggie 2.1.1 Vendor: http://www.mywebland.com/ When the comments are posted there's no check for "script" tags allowing a script injection attack. Proof of Concept scriptalert"Hi world!";/script ..-= DominusVis =-.. Infektion Group Brazil...
CVE-2005-1140
Cross-site scripting XSS vulnerability in myBloggie 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the comments...
Code insertion in Blogger comments
Having notified Blogger of this twice over the course of a number of months, and not seeing them take any action beyond saying that they'll look at it or warn their users, I think it's time to warn people. Under the following conditions, Blogger weblogs are vulnerable to executable code insertion...