Multiple browsers digest authentication request splitting

It's possible to inject new line characters to HTTP request headers thorugh username...

MoinMoin 1.5.x - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23676/info MoinMoin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

MoinMoin 1.5.x - index.php Cross-Site Scripting

MoinMoin 1.5.x - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/23676/info MoinMoin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script co...

MailBee WebMail Pro 3.4 - 'Check_login.asp' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23481/info MailBee WebMail Pro is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

Microsoft Content Management Server Cross-Site Scripting Vulnerability

Description Microsoft Content Management Server MCMS is prone to an unspecified cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in...

PHPwebnews 0.1 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23448/info The 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecti...

PHPwebnews 0.1 - 'iklan.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23448/info The 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecti...

iDefense Security Advisory 03.29.07: IBM Lotus Sametime JNILoader Arbitrary DLL Load Vulnerability

IBM Lotus Sametime JNILoader Arbitrary DLL Load Vulnerability iDefense Security Advisory 03.29.07 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 29, 2007 I. BACKGROUND IBM Corp.'s Lotus Sametime product provides a real-time online conferencing solution. More information on the product...

Fizzle 0.5 - RSS Feed HTML Injection

Fizzle 0.5 - RSS Feed HTML Injection source: https://www.securityfocus.com/bid/23144/info Fizzle is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script...

Adobe Reader plug-in AcroPDF.dll 8.0.0.0 Resource Consumption

Exploit for unknown platform in category dos / poc ============================================================= Adobe Reader plug-in AcroPDF.dll 8.0.0.0 Resource Consumption =============================================================...

[Full-disclosure] Extending JavaScript Portscanning to Include Banner Grabbing

There's a new paper/advisory at: http://bindshell.net/papers/ftppasv Here's a quick summary: A common implementation flaw in FTP clients allows FTP servers to cause clients to connect to other hosts. This seemly small vulnerability has some interesting consequences for web browser security namely...

Built2go News Manager 1.0 Blog - news.php Multiple Cross-Site Scripting Vulnerabilities

Built2go News Manager 1.0 Blog - news.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/22783/info Built2Go News Manager Blog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker...

Active Calendar 1.2 - datajs.php?css Cross-Site Scripting

Active Calendar 1.2 - datajs.php?css Cross-Site Scripting source: https://www.securityfocus.com/bid/22705/info Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

Active Calendar 1.2 - '/data/flatevents.php?css' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22705/info Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

Active Calendar 1.2 - '/data/m_2.php?css' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22705/info Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

Active Calendar 1.2 - '/data/js.php?css' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22705/info Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

EWay 4 - Default.APSX Cross-Site Scripting

source: https://www.securityfocus.com/bid/22528/info eWay is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

Atlassian JIRA 3.7.3 - BrowseProject.JSPA Cross-Site Scripting

source: https://www.securityfocus.com/bid/22503/info Atlassian JIRA is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user ...

Symantec Web Security多个拒绝服务和跨站脚本漏洞

Symantec Web Security安全产品不正确检查嵌入在HTML标记中，包含错误或者阻止页消息的返回给客户端的URL。 攻击者可以嵌入恶意命令到部分URL，客户端浏览器将执行恶意命令。目前没有详细漏洞细节提供。 Symantec Web Security 3.0.1 build 3.01.68 Symantec Web Security 3.0.1 build 3.01.67 Symantec Web Security 3.0.1 build 3.01.63 Symantec Web Security 3.0.1 build 3.01.62 Symantec Web...

212Cafe Guestbook 4.00 - show.php Cross-Site Scripting

212Cafe Guestbook 4.00 - show.php Cross-Site Scripting source: https://www.securityfocus.com/bid/22173/info 212Cafe Guestbook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have...