CVE-2010-3773: Undefined Security Weakness

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute...

CVE-2010-3771: Undefined Security Weakness

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle injection of an ISINDEX element into an about:blank page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to redirection to a...

CVE-2010-3773

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute...

Contenido CMS 4.8.12 XSS Vulnerabilities

Exploit for php platform in category web applications ======================================== Contenido CMS 4.8.12 XSS Vulnerabilities ======================================== Product: Contenido CMS Vendor: four for business AG http://www.contenido.org/ Vulnerable Version: 4.8.12 and Probably...

WordPress Feed List 2.61.01 Cross Site Scripting

------------------------------------------------------------------------ Software................WordPress Feed List 2.61.01 Vulnerability...........Reflected Cross-site Scripting Download................http://wordpress.org/extend/plugins/feedlist/ Release Date............11/5/2010 Tested...

MiniBB 2.5 Cross Site Scripting / SQL Injection

====================================== Vulnerability ID: HTB22670 Reference: http://www.htbridge.ch/advisory/bbcodexssinminibb.html Product: MiniBB Vendor: MiniBB.com http://www.minibb.com/ Vulnerable Version: 2.5 Vendor Notification: 21 October 2010 Vulnerability Type: XSS Cross Site Scripting...

XSS in Textpattern CMS

Vulnerability ID: HTB22672 Reference: http://www.htbridge.ch/advisory/xssintextpatterncms.html Product: Textpattern CMS Vendor: Team Textpattern http://textpattern.com/ Vulnerable Version: 4.2.0 Vendor Notification: 21 October 2010 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by...

BBcode XSS in MiniBB

Vulnerability ID: HTB22670 Reference: http://www.htbridge.ch/advisory/bbcodexssinminibb.html Product: MiniBB Vendor: MiniBB.com http://www.minibb.com/ Vulnerable Version: 2.5 Vendor Notification: 21 October 2010 Vulnerability Type: XSS Cross Site Scripting Status: Not Fixed, Vendor Alerted,...

NinkoBB 1.3RC5 XSS Vulnerability

Exploit for php platform in category web applications ================================ NinkoBB 1.3RC5 XSS Vulnerability ================================ Product: NinkoBB Vendor: NinkoBB http://ninkobb.com Vulnerable Version: 1.3RC5 and probably prior versions Vendor Notification: 13 October 2010...

XSS vulnerability in Zomplog

Vulnerability ID: HTB22644 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinzomplog2.html Product: Zomplog Vendor: Gerben Schmidt http://www.zomp.nl/zomplog/ Vulnerable Version: 3.9 and probably prior versions Vendor Notification: 13 October 2010 Vulnerability Type: XSS Cross Site...

sNews CMS - Multiple Cross-Site Scripting Vulnerabilities

Vulnerability ID: HTB22638 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinsnews1.html Product: sNews Vendor: sNews Team tp://www.snewscms.com/ Vulnerable Version: 1.7 and probably prior versions Vendor Notification: 05 October 2010 Vulnerability Type: XSS Cross Site Scripting Status...

PluXml 5.0.1 Cross Site Scripting

==================================== Vulnerability ID: HTB22631 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinpluxml.html Product: PluXml Vendor: PluXml Team http://pluxml.org/ Vulnerable Version: 5.0.1 and probably prior versions Vendor Notification: 29 September 2010 Vulnerabilit...

XSS vulnerability in Expression CMS

Vulnerability ID: HTB22617 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinexpressioncms.html Product: Expression Vendor: Backbone Technology http://www.backbonetechnology.com Vulnerable Version: Current at 18.09.2010 and Probably Prior Versions Vendor Notification: 22 September 2010...

Lantern CMS Cross Site Scripting

================================== Vulnerability ID: HTB22621 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinlanterncms1.html Product: Lantern CMS Vendor: Lantern http://www.lanterncms.com/www/html/7-home-page.asp Vulnerable Version: Current at 18.09.2010 and Probably Prior Versions...

expression-xss.txt

=================================== Vulnerability ID: HTB22618 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinexpressioncms1.html Product: Expression Vendor: Backbone Technology http://www.backbonetechnology.com Vulnerable Version: Current at 18.09.2010 and Probably Prior Versions...

MODx Revolution 2.0.2-pl Cross Site Scripting

------------------------------------------------------------------------ Software................MODx Revolution 2.0.2-pl Vulnerability...........Reflected Cross-site Scripting Download................http://modxcms.com Release Date............9/28/2010 Tested On...............Windows Vista + XAM...

Limny 2.1 Cross Site Scripting

------------------------------------------------------------------------ Software................Limny 2.1 Vulnerability...........Reflected Cross-site Scripting Download................http://www.limny.org/ Release Date............9/15/2010 Tested On...............Windows Vista + XAMPP...

Mollify 1.6 Cross Site Scripting

------------------------------------------------------------------------ Software................Mollify 1.6 Vulnerability...........Reflected Cross-site Scripting Download................http://freshmeat.net/projects/mollify Release Date............9/15/2010 Tested On...............Windows Vista...

CVE-2010-2762: Undefined Security Weakness

The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper aka SJOW implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrom...

SJOW creates scope chains ending in outer object — Mozilla

Mozilla developer Blake Kaplan reported that the wrapper class XPCSafeJSObjectWrapper SJOW, a security wrapper that allows content-defined objects to be safely accessed by privileged code, creates scope chains ending in outer objects. Users of SJOWs which expect the scope chain to end on an inner...