rsaXSS.txt

RSA XSS Vulnerabilities Author: Rodrigo Gutierrez Affected: RSA "Speaking of Security" Blog Status: Notified Hereby Vendor url: http://www.rsasecurity.com Background. RSA secures more than 15 million user identities, safeguards trillions of business transactions annually and manages the...

[UNIX] Blog Torrent Remote User and Password Disclosure

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

pluggedBlog.txt

Plugged-Blog XSS and SQL-Injection flaw & Remove Admin vendor url: http://www.pluggedout.com advisory: http://falcondeoro.blogspot.com/2005/07/plugged-blog-xss-and-sql-injection.html vendor notify: yes exploit available: yes Plugged-Blog is a CMS WebBlog-Portal content management systen, theinsta...

CVE-2005-2416

Multiple cross-site scripting XSS vulnerabilities in Contrexx before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 term parameter to the search module or 2 title in the blog aggregation module...

CVE-2005-2416

Multiple cross-site scripting XSS vulnerabilities in Contrexx before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 term parameter to the search module or 2 title in the blog aggregation module...

CVE-2005-2416: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Contrexx before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 term parameter to the search module or 2 title in the blog aggregation module...

Hardened-PHP Project Security Advisory 2005-11.59

Hardened PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Multiple vulnerabilities in Contrexx Release Date: 2005/07/21 Last Modified: 2005/07/18 Author: Christopher Kunz Application: Contrexx 1.0.5 Severity: Cross-Site Scripting, SQL injection and information disclosure, passwo...

Contrexx 1.0.4 - Multiple Input Validation Vulnerabilities

Contrexx 1.0.4 - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/14352/info Contrexx is affected by multiple input validation vulnerabilities. These issues can allow an attacker to carry out HTML injection, SQL injection and information disclosure attacks...

CVE-2005-2229

Blog Torrent 0.92 and earlier stores sensitive files under the web document root in the 1 data or 2 torrents directories with insufficient access control, which allows remote attackers to obtain sensitive information such as account names and password hashes, as demonstrated using data/newusers...

CVE-2005-2229

Blog Torrent 0.92 and earlier stores sensitive files under the web document root in the 1 data or 2 torrents directories with insufficient access control, which allows remote attackers to obtain sensitive information such as account names and password hashes, as demonstrated using data/newusers...

CVE-2005-2229

Blog Torrent 0.92 and earlier stores sensitive files under the web document root (in the data or torrents directories) with insufficient access control, enabling remote bidders to obtain sensitive information such as account names and password hashes (e.g., via data/newusers). Affected software: ...

CVE-2005-2229: Undefined Security Weakness

Blog Torrent 0.92 and earlier stores sensitive files under the web document root in the 1 data or 2 torrents directories with insufficient access control, which allows remote attackers to obtain sensitive information such as account names and password hashes, as demonstrated using data/newusers...

CVE-2005-1946

Multiple SQL injection vulnerabilities in Invision Blog before 1.1.2 Final allow remote attackers to execute arbitrary SQL commands via the 1 eid parameter to an editentry, replyentry, or editcomment action, or 2 the mid parameter to an aboutme action...

CVE-2005-1945

Cross-site scripting XSS vulnerability in the converthighlitewords function in Invision Blog before 1.1.2 Final allows remote attackers to inject arbitrary web script or HTML via double hex encoded highlight data...

CVE-2005-1945

CVE-2005-1945 affects Invision Blog prior to 1.1.2 Final. The vulnerability resides in the convert_highlite_words function, allowing remote attackers to inject arbitrary web script or HTML via double hex encoded highlight data (XSS). Impact is cross-site scripting with partial integrity impact as...

CVE-2005-1946

CVE-2005-1946 affects Invision Blog (Invision Community Blog). The issue is multiple SQL injection vulnerabilities in the application’s input handling, allowing remote attackers to inject arbitrary SQL via the parameters (in editentry, replyentry, or editcomment actions) or (in the aboutme acti...

CVE-2005-1945: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the converthighlitewords function in Invision Blog before 1.1.2 Final allows remote attackers to inject arbitrary web script or HTML via double hex encoded highlight data...

CVE-2005-1946: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Invision Blog before 1.1.2 Final allow remote attackers to execute arbitrary SQL commands via the 1 eid parameter to an editentry, replyentry, or editcomment action, or 2 the mid parameter to an aboutme action...

Invision Community Blog Vulnerabilities

GulfTech Security Research June 7th, 2005 Vendor : Invision Power Services URL : http://www.invisionblog.com Version : All Versions Prior To 1.1.2 Final Risk : Multiple Vulnerabilities Description: Invision Blog is a community based blogging software that can be integrated into Invision Power...

Invision Community Blog Multiple Vulnerabilities (SQLi, XSS)

The remote host is running Invision Community Blog, a plugin for Invision Power Board that lets users have their own blogs. The version installed on the remote host fails to properly sanitize user-supplied data making it prone to multiple SQL injection and cross-site scripting vulnerabilities...