XSS in Horde Application Framework <=3.3.8, icon_browser.php

Hi, Horde Application Framework v3.3.8 and lower are subject to a cross site scripting XSS vulnerability. The iconbrowser.php script fails to properly sanitize user supplied input to the 'subdir' URL parameter before printing it out as part of a HTML formatted error message. The following URL can...

Horde Application Framework 3.3.8 Cross Site Scripting

Hi, Horde Application Framework v3.3.8 and lower are subject to a cross site scripting XSS vulnerability. The iconbrowser.php script fails to properly sanitize user supplied input to the 'subdir' URL parameter before printing it out as part of a HTML formatted error message. The following URL can...

Horde util/icon_browser.php subdir Parameter XSS

The version of the Horde application framework hosted on the remote web server fails to sanitize user input to the 'subdir' parameter of the 'util/iconbrowser.php' script before using it to generate dynamic HTML output. An attacker may be able to leverage this issue to inject arbitrary HTML or...

Horde Application Framework 3.3.8 - icon_browser.php Cross-Site Scripting

Horde Application Framework 3.3.8 - iconbrowser.php Cross-Site Scripting source: https://www.securityfocus.com/bid/43001/info Horde Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this...

Horde Application Framework 3.3.8 - 'icon_browser.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/43001/info Horde Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting us...

SQL injection vulnerability in MODx CMS

Vulnerability ID: HTB22414 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinmodxcms.html Product: MODx CMS and Application Framework Vendor: MODx Vulnerable Version: 1.0.3 and Probably Prior Versions Vendor Notification: 28 May 2010 Vulnerability Type: SQL Injection Status: N...

SQL injection vulnerability in MODx CMS and Application Framework

Vulnerability ID: HTB22412 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinmodxcmsandapplicationframework.html Product: MODx CMS and Application Framework Vendor: MODx Vulnerable Version: 1.0.3 and Probably Prior Versions Vendor Notification: 28 May 2010 Vulnerability Type:...

Fedora Update for zikula FEDORA-2010-8464

Check for the Version of zikula OpenVAS Vulnerability Test Fedora Update for zikula FEDORA-2010-8464 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Fedora Update for zikula FEDORA-2010-8501

Check for the Version of zikula OpenVAS Vulnerability Test Fedora Update for zikula FEDORA-2010-8501 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

[SECURITY] Fedora 12 Update: zikula-1.2.3-1.fc12

A free open source Web Application Framework. It can be used to develop robust, secure, interactive and editable websites and web based applications. Zikula is written in PHP, object oriented, and fully modular. It requires a database and may use all leading database platforms like MySQL,...

JVN#90248889: Interstage Application Server vulnerable in request processing

The Servlet service provided by the Interstage Application Server from Fujitsu Limited, contains a vulnerability where certain requests may be handled improperly depending on the settings at the load balancing device. Impact Invalid requests may be processed or user information may be leaked...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 func parameter to index.php, or the 2 lang parameter to index.php, which is not properly handled by ZLanguage.php...

CVE-2010-1732

Cross-site request forgery CSRF vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authentication of administrators for requests that change the administrator email address updateemail action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authentication of administrators for requests that change the administrator email address updateemail action...

CVE-2010-1732

Zikula Application Framework up to version 1.2.3 has a CSRF vulnerability in the users module (updateemail action) that could allow an attacker to hijack an administrator’s email address. The flaw is addressed in the 1.2.3 release, which upstream fixed two security issues (XSS and CSRF) and remov...

CVE-2010-1732

Cross-site request forgery CSRF vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authentication of administrators for requests that change the administrator email address updateemail action...

CVE-2010-1724

CVE-2010-1724 affects Zikula Application Framework (v1.2.2 and possibly earlier). The vulnerability is XSS in the index.php handling of func and lang parameters via ZLanguage.php, enabling remote injection of arbitrary script/HTML. OpenVAS entries corroborate multiple XSS/CSRF issues for Zikula. ...

CVE-2010-1724

Multiple cross-site scripting XSS vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 func parameter to index.php, or the 2 lang parameter to index.php, which is not properly handled by ZLanguage.php...

Zikula Application Framework 1.2.2 Cross Site Request Forgery

Vulnerability ID: HTB22351 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinzikulaapplicationframework.html Product: Zikula Application Framework Vendor: Zikula Software Foundation Vulnerable Version: 1.2.2 and Probably Prior Versions Vendor Notification: 19 April 2010 Vulnerability Type: CSR...

XSRF (CSRF) in Zikula Application Framework

Vulnerability ID: HTB22351 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinzikulaapplicationframework.html Product: Zikula Application Framework Vendor: Zikula Software Foundation Vulnerable Version: 1.2.2 and Probably Prior Versions Vendor Notification: 19 April 2010 Vulnerability Type: CSR...