web@all 1.1 - 'url' Cross-Site Scripting

source: https://www.securityfocus.com/bid/45976/info web@all is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

PivotX 2.2 - '/pivotx/includes/timwrapper.php?src' Cross-Site Scripting

source: https://www.securityfocus.com/bid/45996/info PivotX is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

WordPress Audio Plugin 0.5.1 - Cross-Site Scripting Vulnerability

This audio plugin's "showfile" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-base...

WordPress Plugin WP Featured Post with Thumbnail 3.0 - 'src' Cross-Site Scripting

source: https://www.securityfocus.com/bid/45998/info The WP Featured Post with Thumbnail Plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

LifeType 1.2.10 - HTTP Referer Persistent Cross-Site Scripting

LifeType 1.2.10 - HTTP Referer Persistent Cross-Site Scripting Exploit Title: lifetype 1.2.10 http referer XSS Date: 11-1-2010 Author: Saif El-Sherei Software Link: http://lifetype.net/page/downloads Version: 1.2.10 Tested on: firefox 3.0.15 failure to sanitize the http referer header in index.ph...

Lifetype 1.2.10 HTTP Referer Cross Site Scripting

Exploit Title: lifetype 1.2.10 http referer XSSstored Date: 11-1-2010 Author: Saif El-Sherei Software Link: http://lifetype.net/page/downloads Version: 1.2.10 Tested on: firefox 3.0.15 failure to sanitize the http referer header in index.php results in a cross site scripting attack against admins...

Microsoft Internet Explorer MSADO CacheSize Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. This vulnerability was submitted to the ZDI via at the annual Pwn2Own competition at CanSecWest. User interaction is required to exploit this vulnerability in that the...

Microsoft Data Access Components Data Source Name Buffer Overflow Vulnerability

Description Microsoft Data Access Components MDAC are prone to a buffer-overflow vulnerability because they fail to properly bounds-check user-supplied data. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks will...

Joomla! 1.0.x - 'ordering' Cross-Site Scripting

source: https://www.securityfocus.com/bid/45679/info The Joomla! Search component is prone to a cross-site-scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Openfire 3.6.4 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/45682/info Openfire is prone to multiple cross-site-scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an...

The Year of the Sandbox

As predicted by researcher Dino Dai Zovi in these pages in January, 2010 turned out to be the year of the sandbox. Attackers for years have been focusing their attention on browsers and other Web apps and using them as jumping off points for further attacks on compromised PCs. Vendors finally beg...

FreeNAS 0.7.2.5543 - index.php Multiple Cross-Site Scripting Vulnerabilities

FreeNAS 0.7.2.5543 - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/45522/info FreeNAS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to...

OpenFiler - device Cross-Site Scripting

OpenFiler - device Cross-Site Scripting source: https://www.securityfocus.com/bid/45523/info Openfiler is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser...

Microsoft Internet Explorer Uninitialized Object CVE-2010-3340 Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks will cause denial-of-service conditions. Technologies Affected Avaya Au...

Microsoft Internet Explorer Uninitialized Object CVE-2010-3343 Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks will cause denial-of-service conditions. Technologies Affected Avaya Au...

Microsoft Internet Explorer CVE-2010-3342 Cross Domain Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability because the application fails to properly enforce the same-origin policy. An attacker can exploit this issue to access content from a browser window in another domain or security zone. This may...

Microsoft Internet Explorer CVE-2010-3348 Cross Domain Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability because the application fails to properly enforce the same-origin policy. An attacker can exploit this issue to access content from a browser window in another domain or security zone. This may...

Microsoft Internet Explorer Select HTML Element Use-After-Free Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks will cause denial-of-service conditions. Technologies Affected Avaya Au...

PHP TopSites 2.1 - '/rate.php' Cross-Site Scripting / SQL Injection

source: https://www.securityfocus.com/bid/45389/info PHP TopSites is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to execute arbitrary script code in t...

Multiple XSS in Solarwinds Orion NPM 10.1

Values placed in the URI of the browser are rendered correctly. Orion NPM 10.1 has just been released, so there is no known fix available as of yet. Examples: Most "variable=" that I've checked are vulnerable:...