Spyce 2.1.3 - spyceexamplesrequest.spy?name Cross-Site Scripting

Spyce 2.1.3 - spyceexamplesrequest.spy?name Cross-Site Scripting source: https://www.securityfocus.com/bid/27898/info Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution. An attacker may leverage these issues to execu...

Spyce 2.1.3 - spyce/examples/automaton.spy Direct Request Error Message Information Disclosure

source: https://www.securityfocus.com/bid/27898/info Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

Spyce 2.1.3 - '/spyce/examples/formtag.spy' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/27898/info Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

Spyce 2.1.3 - docsexamplesredirect.spy Multiple Cross-Site Scripting Vulnerabilities

Spyce 2.1.3 - docsexamplesredirect.spy Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/27898/info Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution. An attacker may leverage...

[Full-disclosure] Web 2.0 backdoors made easy with MSIE & XMLHttpRequest

As you probably know, the famous "web 2.0" XMLHttpRequest object allows client-side web scripts to send nearly arbitrary HTTP requests, and then freely analyze and manipulate the returned response, including HTTP headers. This gives an unprecedented level of control over your browser to the autho...

SOL6920 - Cross-site scripting vulnerabilities

Multiple cross-site scripting XSS vulnerabilities exist in the FirePass Administrative Console pages. The affected FirePass URLs fail to fully sanitize certain URL arguments before the requested web page content is returned to the browser. It is possible for an attacker to create web pages, email...

DWR protection bypass

Protection againsts functions access is implemented in client side...

Project Server 2003 - Credential Disclosure

============================================================== Project Server 2003 - Credential Disclosure [email protected] ============================================================== Microsoft Project server 2003 implements a thick client for some of the functionality. The...

CVE-2006-4068

The CVE concerns a client-side pswd.js script that relies on the user’s environment to verify a username/password against hard-coded hashed values on the server. The hashing scheme reportedly produces a large number of collisions, which can ease offline brute-force attempts by an attacker. The de...

CVE-2006-3914

Cross-site scripting XSS vulnerability in Blackboard Academic Suite 6.2.3.23 allows remote authenticated users to inject arbitrary HTML or web script by bypassing client-side validation through disabling JavaScript when submitting an essay response, which has no server-side validation before bein...

CVE-2006-3914

Cross-site scripting XSS vulnerability in Blackboard Academic Suite 6.2.3.23 allows remote authenticated users to inject arbitrary HTML or web script by bypassing client-side validation through disabling JavaScript when submitting an essay response, which has no server-side validation before bein...

hdweGUEST <= 2.1.1 Cross Site Scripting Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: hdweGUEST = 2.1.1 Cross Site Scripting Vulnerabilities Release Date: 2006/07/18 Last Modified: 2006/07/18 Author: Tamriel tamriel at gmx dot net Application: hdweGUEST 2.1.1 Risk: Low Vendor Status: contacted | no reply | no patch available...

horde3113010.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0011 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ Horde 3.1.1, 3.0.10 Multiple Security Issues +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON July 05, 2006 PUBLISHED AT...

iDefense Security Advisory 06.13.06: Windows MRXSMB.SYS MrxSmbCscIoctlCloseForCopyChunk DoS

Windows MRXSMB.SYS MrxSmbCscIoctlCloseForCopyChunk DoS iDefense Security Advisory 06.13.06 http://www.idefense.com/application/poi/display?type=vulnerabilities June 13, 2006 I. BACKGROUND Microsoft Windows Operating System is system software for Intel based PCs. More information can be found at t...

eBD-en.txt

=============================== - Advisory - =============================== Tittle: Several flaws in e-business designer Risk: Critical Date: 03.May.2006 Author: Pedro Andújar URL: http://www.digitalsec.es http://www.514.es/ .: INTRO :. eBD is an Integrated Development Environment for the...

Code injection

add.asp in DUware DUbanner 3.1 allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions, such as ASP files, probably due to client-side enforcement that can be bypassed. NOTE: some of these details are obtained from third party information, since the raw sour...

CVE-2006-2428

add.asp in DUware DUbanner 3.1 allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions, such as ASP files, probably due to client-side enforcement that can be bypassed. NOTE: some of these details are obtained from third party information, since the raw sour...

CVE-2006-2428

The CVE-2006-2428 issue affects DUbanner 3.1 (DUware) via the add.asp endpoint, where uploading files with arbitrary extensions (e.g., ASP) can lead to remote code execution. Root cause cited is weak server-side validation/enforcement that can be bypassed by clients. Impact is remote code executi...

CVE-2006-0230

Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator privileges via a modified client that sends certain XML requests...

Multiple Symantec Scan Engine network content filtering server security vulnerabilities

Administrative interface passwords are checked on client side, fixed encryption key is used, critical information leak...