Possible link spoofing on the homepage when anchors are used

More info at https://typo3.org/security/advisory/typo3-core-sa-2014-003...

CVE-2014-9182

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header...

CVE-2014-9182

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header...

CVE-2014-9182

Anchor CMS 0.9.2 and earlier is affected by CVE-2014-9182 due to a header-injection flaw in models/comment.php. The vulnerability arises from building mail headers using a Host header value, enabling remote attackers to inject arbitrary headers into outgoing mail messages via CRLF manipulation. T...

CVE-2014-9182

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header...

PT-2014-8873

Name of the Vulnerable Software and Affected Versions Anchor CMS versions 0.9.2 and earlier Description The issue allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header in the models/comment.php file. Recommendations For Anchor CMS versions 0.9.2 and...

CVE-2014-9182: Improper Neutralization of Input During Web Page Generation

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header...

Anchor CMS 0.9.2 Header Injection

Anchor CMS = 0.9.2 Current Version header injection in anchor/models/comment.php $headers = 'MIME-Version: 1.0' . "\r\n"; $headers .= 'Content-type: text/html; charset=utf-8' . "\r\n"; $headers .= 'From: notifications@' . $SERVER'HTTPHOST' . "\r\n"; 49: mail$to, 'comments.notifysubject', $message...

Anchor CMS 0.9.2 Header Injection Vulnerability

Anchor CMS versions 0.9.2 and below suffer from a header injection vulnerability. Anchor CMS = 0.9.2 Current Version header injection in anchor/models/comment.php $headers = 'MIME-Version: 1.0' . "\r\n"; $headers .= 'Content-type: text/html; charset=utf-8' . "\r\n"; $headers .= 'From:...

Anchor CMS 0.9.1 - Stored XSS Vulnerability

No description provided by source. Exploit Title : AnchorCMS Stored XSS exploit v0.9.1 Exploit Author: DURAKIBOX / dn5 Website : halisduraki.com Email : [email protected] Date : 18.7.2013. CMS uri : http://anchorcms.com/ Version : AnchorCMS = 0.9.1 About the CMS Anchor is a super-simple, lightweigh...

Mozilla Suite/Firefox/Thunderbird Nested Anchor Tag Status Bar Spoofing Weakness

No description provided by source. source: http://www.securityfocus.com/bid/12798/info Mozilla Suite/Firefox and Thunderbird are reported prone to a URI obfuscation weakness. The issue is reported to manifest when 'Save Link As...' functionality is invoked on an malicious anchor tag. This issue m...

X-Cart Gold 4.5 (products_map.php symb parameter) XSS Vulnerability

No description provided by source. Exploit Title: X-Cart Gold 4.5 productsmap.php symb parameter XSS Vulnerability Date: Jul 21 2012 Author: muts Version: X-Cart Gold 4.5 Vendor URL: http://www.x-cart.com/ X-Cart Gold implements a degree of XSS filtering but it is incomplete. The symb parameter o...

CVE-2013-5099

Cross-site scripting XSS vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field. NOTE: some sources have reported that comments.php is vulnerable, but certain functions from comments.php are us...

Cross site scripting

Cross-site scripting XSS vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field. NOTE: some sources have reported that comments.php is vulnerable, but certain functions from comments.php are us...

CVE-2013-5099

Cross-site scripting XSS vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field. NOTE: some sources have reported that comments.php is vulnerable, but certain functions from comments.php are us...

CVE-2013-5099

Summary: CVE-2013-5099 affects Anchor CMS 0.9.1. A cross-site scripting (XSS) vulnerability exists in article.php when comments are enabled, allowing remote attackers to inject arbitrary script/HTML via the Name field. Some sources note involvement of comments.php, but article.php calls relevant ...

PT-2013-5364

Name of the Vulnerable Software and Affected Versions Anchor CMS version 0.9.1 Description A cross-site scripting XSS issue exists in article.php when comments are enabled, allowing remote attackers to inject arbitrary web script or HTML via the Name field. Recommendations For Anchor CMS version...

CVE-2013-5099: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field. NOTE: some sources have reported that comments.php is vulnerable, but certain functions from comments.php are us...

CVE-2013-4997

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in 1 an anchor identifier to setup/index.php or 2 a chartTitle aka chart title value...

DEBIAN-CVE-2013-4997

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in 1 an anchor identifier to setup/index.php or 2 a chartTitle aka chart title value...