XSS bug: usernames not HTML-encoded in all places

When signing up for an account, it is possible to enter a username like "fred". Confluence will accept this, and on certain pages, render it as raw HTML to the user, opening the possibility of cross-site scripting XSS attacks. Two places I've spotted the raw HTML so far: - Most prominently, when ...

Enigma 2 WordPress Bridge (boarddir) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ====================================================================== Enigma 2 WordPress Bridge boarddir Remote File Include Vulnerability ======================================================================...

Flatnuke 2.5.8 - userlang Local Inclusion Delete All Users

Flatnuke 2.5.8 - userlang Local Inclusion Delete All Users !/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i;...

Flatnuke 2.5.8 (userlang) Local Inclusion / Delete All Users Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? printr' ----------------------------------------------------------------------------- Flatnuke 2.5.8 "userlang" arbitrary local inclusion/delete all users exploit by rgod [email protected] site: http://retrogod.altervista.o...

Flatnuke 2.5.8 (userlang) Local Inclusion / Delete All Users Exploit

Exploit for unknown platform in category web applications ==================================================================== Flatnuke 2.5.8 userlang Local Inclusion / Delete All Users Exploit ==================================================================== !/usr/bin/php -q -d shortopentag=o...

Flatnuke 2.5.8 - 'userlang' Local Inclusion / Delete All Users

!/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if...

All Users startup folder left open if unattended install and OEMP reinstall=1

About a month ago I posted the following to the win2ksecadvice list. However, I received no response. I thought I'd try again since I consider this problem to be pretty serious since it will allow any user to introduce a code stream on another user. I recently noticed a problem with Windows 2000...