14488 matches found
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Phpwebgallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 login or 2 mailaddress field in Register.php, or the 3 searchauthor, 4 mode, 5 startyear, 6 endyear, or 7 datetype field in Search.php, a different...
Symantec Security Advisory SYM07-002 http://www.symantec.com/avcenter/security/Content/2007.02.22.html BID 22564 22 Feb, 2007 Stack Overflow in Third-Party ActiveX Controls affects Multiple Vendor Products Including Some Symantec Consumer Products and Automated Support Assistant Revision History...
Microsoft Malware Protection Engine Crafted PDF Code Execution (MS07-010; CVE-2006-5720)
Portable Document Format PDF is an open file format created by Adobe Systems. It is used for representing two-dimensional documents in a device and resolution independent fixed-layout document format. A remote code execution vulnerability has been reported in Microsoft Malware Protection Engine. ...
Microsoft Windows Malformed RTF Handling Code Execution (MS07-011; CVE-2006-1311; CVE-2007-0025; CVE-2007-0026)
Rich Text Format RTF provides a format for text and graphics interchange that can be used with different operating systems. OLE is the technology that applications use to create and edit compound documents. By using OLE technology, an application can provide embedding and linking support. By...
CVE-2006-7058
CVE-2006-7058 : Concrete XSS vulnerabilities in the Sphider web search implementation (before 1.3.1c) allow remote attackers to inject arbitrary script/HTML via the catid parameter in two templates (standard/search_form.html and dark/search_form.html). Root cause: unsanitized catid value enabling...
CVE-2006-7059
CVE-2006-7059 affects Scriptsez.net E-Dating System. The issue is multiple cross-site scripting (XSS) vulnerabilities that let remote attackers inject arbitrary script/HTML via encoded entities (') in IMG tags to (1) messages, (2) profile fields, or (3) the id parameter in a dologin opera...
CVE-2006-7063
The vulnerability (CVE-2006-7063) affects TinyPHPforum before or up to version 3.6, in profile.php. Remote attackers can trigger a directory traversal by supplying .. sequences in the uname parameter, enabling inclusion and execution of arbitrary files. The CVE is documented with a high impact sc...
CVE-2006-7062
CVE-2006-7062 affects Kamgaing Email System (kmail) version ≤ 2.3. The vulnerability in calendar.php arises from handling an invalid d parameter, causing an error message that leaks the server’s full filesystem path. This is an information disclosure (remote, network-based) with a CVSS v2 base sc...
CVE-2006-7061
CVE-2006-7061 affects Scriptsez.net E-Dating System. The vulnerability stems from storing data files with predictable names under the web document root and insufficient access control, enabling remote attackers to read private messages and potentially leverage them for XSS. The connected document...
CVE-2006-7060
The CVE-2006-7060 entry concerns the Scriptsez.net E-Dating System, specifically the file/component cindex.php. Affected behavior is a remote disclosure where an invalid id parameter in a dologin action causes an error message that reveals the full filesystem path, leading to potential informatio...
CVE-2006-7064
CVE-2006-7064 covers a cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) versions 2.1.6 and earlier, specifically in forum/admin.php via the phpinfo parameter. The underlying issue is that the phpinfo input is reflected into the administrator session in a way that allows an a...
CVE-2006-7057
Technical details (affected versions, root cause nuances, and remediation) are not provided in the supplied connected documents. Monitor for updates from official advisories.
CVE-2006-7051
The systimercreate function in posix-timers.c for Linux kernel 2.6.x allows local users to cause a denial of service memory consumption and possibly bypass memory limits or cause other processes to be killed by creating a large number of posix timers, which are allocated in kernel memory but are...
CVE-2006-7042
Cross-site scripting XSS vulnerability in directory/index.php in Chipmunk directory allows remote attackers to inject arbitrary web script or HTML via the start parameter...
CVE-2006-7055
CVE-2006-7055 describes a PHP remote file inclusion in TotalCalendar 2.30 and earlier. The vulnerability is triggered via the inc_dir parameter in index.php, allowing a remote attacker to cause arbitrary PHP code execution by supplying a URL. This is a separate vector from CVE-2006-1922 and CVE-2...
CVE-2006-7043
CVE-2006-7043 describes multiple XSS vulnerabilities in Chipmunk Blogger. Remote authenticated users can inject arbitrary script/HTML via (1) posts, (2) profile names, and (3) a javascript: URI in a URL argument in the photo gallery. The NVD notes a low base score (3.5) with attack vector Network...
CVE-2006-7053
The CVE-2006-7053 entry concerns Arkoon FAST360 UTM appliances (versions 3.0 through 3.0/29, 3.1, 3.2, 3.3). The vulnerability allows remote attackers to bypass keyword filtering in the FAST HTTP module and bypass signatures in the IDPS HTTP module by sending crafted URLs that are misinterpreted....
CVE-2006-7052
The CVE-2006-7052 entry affects DotWidget For Articles (dotwidgeta) version 0.2, where multiple PHP remote file inclusion vulnerabilities exist. An attacker can trigger arbitrary code execution by supplying a URL path in the file_path parameter for index.php, showcatpicks.php, and showarticle.php...
CVE-2006-7050
WikkaWiki (Wikka Wiki) prior to 1.1.6.2 contains a Cross‑site Scripting (XSS) vulnerability. The issue allows remote attackers to inject arbitrary JavaScript through (1) events in forced links (url parameter) not properly sanitized in formatters/wakka.php and possibly (2) other vectors in wikka.p...
CVE-2006-7042
CVE-2006-7042 is an XSS vulnerability in Chipmunk’s directory/index.php where an attacker can inject arbitrary web script or HTML via the start parameter. The incident is described as a cross-site scripting issue in Chipmunk directory, with the vulnerable component being directory/index.php. The ...