CVE-2012-2573: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 a SCRIPT element, 2 a crafted Cascading Style Sheets CSS expression property, 3 a CSS expression property in the STYLE...

CVE-2012-2584: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 the Cascading Style Sheets CSS expression property in conjunction with a CSS comment within the STYLE attribute of an IMG...

T-dah Webmail Client 3.2.0-2.3 - Persistent Cross-Site Scripting

T-dah Webmail Client 3.2.0-2.3 - Persistent Cross-Site Scripting !/usr/bin/python ''' Author: loneferret of Offensive Security Product: T-dah Webmail Client Version: 3.2.0-2.3 Vendor Site: http://t-dahmail.sourceforge.net/index.php Software Download: http://sourceforge.net/projects/t-dahmail/...

Surgemail 6.0a4 - Persistent Cross-Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Product: SurgeMail Version: 6.0a4 Vendor Site: http://www.netwinsite.com Software Download: http://netwinsite.com/download.htm Timeline: 29 May 2012: Vulnerability reported to CERT 30 May 2012: Response received from CERT with disclosu...

afterlogic mailsuite pro (VMware Appliance) 6.3 - Persistent Cross-Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Product: AfterLogic Mailsuite Pro VMware Appliance Version: 6.3 Vendor Site: http://www.afterlogic.com/ Software Download: http://www.afterlogic.com/download/ Timeline: 29 May 2012: Vulnerability reported to CERT 30 May 2012: Response...

mailtraq 2.17.3.3150 - Persistent Cross-Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Product: MailTraq Version: 2.17.3.3150Mar 5th, 2012 Vendor Site: http://www.mailtraq.com/ Software Download: http://www.mailtraq.com/30day Timeline: 29 May 2012: Vulnerability reported to CERT 30 May 2012: Response received from CERT...

MailTraq 2.17.3.3150 Cross Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Product: MailTraq Version: 2.17.3.3150Mar 5th, 2012 Vendor Site: http://www.mailtraq.com/ Software Download: http://www.mailtraq.com/30day Timeline: 29 May 2012: Vulnerability reported to CERT 30 May 2012: Response received from CERT...

europ INNET Web Studio Administration Program 2.0 XSS / CSRF / LFI

====================================================== Vulnerable software: Administration Programm v 2.0 Vendor: europ INNET Web Studio, www.europ-innet.com ====================================================== Vulnerabilities: //insertguestbook.php ==============VULNERABLE CODE...

PT-2012-4215

Name of the Vulnerable Software and Affected Versions Drupal Protest module versions 6.x-1.x before 6.x-1.2 Drupal Protest module versions 7.x-1.x before 7.x-1.2 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with the "administer protest" permission to...

Civil Liberties Groups Wary As Little Known UN Body Seeks Greater Role In Regulating Internet

A little known United Nations body, The International Telecommunications Union ITU, is quietly making moves that would give that U.N. and its 192 member-states increased control of the Internet according to a report in the Wall Street Journal. An internal ITU planning document leaked to the Web...

Hexamail Server 4.4.5 - Persistent Cross-Site Scripting

Hexamail Server 4.4.5 - Persistent Cross-Site Scripting Title: Hexamail Server meal.txt XSS pop up alert'Hi, what is this?'; root@bt:/ Send email to the victim: root@bt:/ sendemail -f [email protected] -t [email protected] -xu [email protected] \ -xp bob123 -u "Want some meal..?" -o...

Hexamail Server 4.4.5 - Persistent Cross-Site Scripting

Title: Hexamail Server meal.txt XSS pop up alert'Hi, what is this?'; root@bt:/ Send email to the victim: root@bt:/ sendemail -f [email protected] -t [email protected] -xu [email protected] \ -xp bob123 -u "Want some meal..?" -o message-file=meal.txt -s mail.example.com Vendor timeline ===============...

Hexamail Server <= 4.4.5 Persistent XSS Vulnerability

Exploit for windows platform in category web applications Title: Hexamail Server meal.txt XSS pop up alert'Hi, what is this?'; email protected:/ Send email to the victim: email protected:/ sendemail -f email protected -t email protected -xu email protected \ -xp...

tomcat: authentication bypass and information disclosure

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret...

http-icloud-sendmsg NSE Script

Sends a message to a iOS device through the Apple MobileMe web service. The device has to be registered with an Apple ID using the Find My Iphone application. Script Arguments http-icloud-sendmsg.username the Apple ID username http-icloud-sendmsg.sound boolean specifying if a loud sound should be...

Smell You Later

In 2009, the U.S. Department of Homeland Security hatched a plan to use body-odor as a method of identifying individuals. The DHS wanted to establish odor based biometric signatures that could uniquely identify both friend and foe. It then might be able to determine if changes in odor could be us...

Unfixed XSS vulnerability at www.body-building.co.il

Security researcher Codeshift3r, has submitted on 14/01/2012 a cross-site-scripting XSS vulnerability affecting www.body-building.co.il, which at the time of submission ranked 5083340 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 14/01/2012. ...

CVE-2011-4737: Exposure of Sensitive Information to an Unauthorized Actor

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in client@2/domain@1/odbc/dsn@1/properties/...

Microsoft Internet Explorer Body元素内存破坏漏洞(MS11-081)

BUGTRAQ ID: 49965 CVE ID: CVE-2011-2000 Microsoft Internet Explorer简称MSIE，是微软公司推出的一款网页浏览器。 IE在处理Body元素时在实现上存在内存破坏漏洞，远程攻击者可利用此漏洞远程代码或导致拒绝服务。 Microsoft Internet Explorer 9.x Microsoft Internet Explorer 8.x Microsoft Internet Explorer 7.x Microsoft Internet Explorer 6.x 临时解决方法：...

GAO Calls Out FDIC For Lax Infosecurity Measures

The Federal Deposit Insurance Corporation FDIC has drawn the ire of the Government Accountability Office GAO following an audit of the FDIC’s system this month. A GAO report called the government corporation out for neglecting to use strong passwords, review user access and encrypt sensitive...