firefoxchrome-escalate.txt

Gerry Eisenhaur came with a surprising post http://www.hiredhacker.com/2008/01/19/firefox-chrome-url-handling-directory-traversal/ . Gerry found a issue in Firefox that allows chrome privilege escalation. This is due to weak normalization between URI's that are handled and passed through Firefox...

Unfixed XSS vulnerability at pcsvet.cz

Security researcher DjH, has submitted on 21/01/2008 a cross-site-scripting XSS vulnerability affecting pcsvet.cz, which at the time of submission ranked 42730 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 03/03/2008. It is currently unfixed...

F5 BIG-IP 9.4.3 - 'SearchString' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/27272/info F5 BIG-IP is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

f5-xss.txt

F5 BIG-IP Web Management List Search XSS Product: F5 BIG-IP http://www.f5.com/products/big-ip/ The F5 BIG-IP web management interface contains a cross-site scripting vulnerability in the Search function present on several list-like pages. Parameter SearchString is not sanitized before it gets...

Moodle 1.8.3 - install.php Cross-Site Scripting

Moodle 1.8.3 - install.php Cross-Site Scripting source: https://www.securityfocus.com/bid/27259/info Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the brows...

Snitz Forums 2000 3.4.53.4.6 - Multiple Cross-Site Scripting Vulnerabilities

Snitz Forums 2000 3.4.53.4.6 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/27162/info Snitz Forums 2000 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these...

eTicket 1.5.5.2 - 'admin.php' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/27173/info eTicket is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, a cross-site scripting issue, and an...

WordPress 2.2.3 - wp-adminedit.php?backup Cross-Site Scripting

WordPress 2.2.3 - wp-adminedit.php?backup Cross-Site Scripting source: https://www.securityfocus.com/bid/27123/info WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

IPortalX - blogs.asp?Date Cross-Site Scripting

IPortalX - blogs.asp?Date Cross-Site Scripting source: https://www.securityfocus.com/bid/27044/info iPortalX is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code ...

Adobe Flash Player 8.0.34.0/9.0.x - 'main.swf?baseurl' asfunction: Protocol Handler Cross-Site Scripting

source: https://www.securityfocus.com/bid/26949/info Adobe Flash Player is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

Microsoft Internet Explorer Element Tags Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the underlying computer...

Microsoft Internet Explorer cloneNode() and nodeValue() Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the user's account and possibly the underlying computer...

Microsoft Internet Explorer mshtml.dll Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the user's account and possibly the underlying computer...

Preemptive Protection against Apache HTTP Server 413 Error Page Cross-Site Scripting Vulnerability

A cross-site scripting XSS vulnerability exists in Apache HTTP Server. Apache is a popular web server available for a wide variety of operating systems. Successful exploitation of this vulnerability could result in arbitrary scripting code execution by the user's browser in the context of an...

PR07-14: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN 'my.activation.php3' server-side script

PR07-14: Cross-site Scripting XSS / HTML injection on F5 FirePass 4100 SSL VPN 'my.activation.php3' server-side script Date Found: 19th June 2007 Successfully tested on: version 5.5.2 F5 Networks has confirmed the following versions to be vulnerable: FirePass versions 5.4.1 - 5.5.2 FirePass...

I and expression of the day and is Day-vulnerability warning-the black bar safety net

When you first use the expression the way toxss, you definitely dumbfounded, and kept the bomb box, can't close the browser, eventually you can only sacrifice the task Manager the process ends. Maybe your Other TAB pages are filled to the half has not yet submitted the form, you will be expressio...

Tilde 4.0 - 'Aarstal' Cross-Site Scripting

source: https://www.securityfocus.com/bid/26592/info Tilde is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

ertificate spoofing with subjectAltName and domain name wildcards

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Phishing for Confirmations Certificate spoofing with subjectAltName and domain name wildcards URL: http://nils.toedtmann.net/pub/subjectAltName.txt Version: 2007-11-16-07 Author: Nils Toedtmann [email protected] License: Dual...

Xunlei Thunder PPLAYER.DLL_1_WORK ActiveX Control Buffer Overflow Vulnerability

Description Xunlei Thunder PPlayer ActiveX Control is prone a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the applicati...

VTLS Web Gateway 48.1 - 'Searchtype' Cross-Site Scripting

source: https://www.securityfocus.com/bid/26419/info Web Gateway is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context o...