4562 matches found
wordpress -- unmoderated comments disclosure
Blogsecurity reports: An attacker can read comments on posts that have not been moderated. This can be a real security risk if blog admins are using unmoderated comments comments that have not been made public to hide sensitive notes regarding posts, future work, passwords etc. So please be caref...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in SimpGB 1.46.0 allow remote attackers to execute arbitrary PHP code via a URL in the pathsimpgb parameter to 1 guestbook.php, 2 search.php, 3 mailer.php, 4 avatars.php, 5 ccode.php, 6 comments.php, 7 emoticons.php, 8 gbdownload.php, and possibl...
CVE-2007-2859
Multiple PHP remote file inclusion vulnerabilities in SimpGB 1.46.0 allow remote attackers to execute arbitrary PHP code via a URL in the pathsimpgb parameter to 1 guestbook.php, 2 search.php, 3 mailer.php, 4 avatars.php, 5 ccode.php, 6 comments.php, 7 emoticons.php, 8 gbdownload.php, and possibl...
PT-2007-4163 · Simpgb · Simpgb
Name of the Vulnerable Software and Affected Versions: SimpGB version 1.46.0 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the path simpgb parameter to various PHP scripts, including "guestbook.php", "search.php", "mailer.php", "avatars.php", "ccode.php...
doopCMS13x-xss.txt
Doop Content Management System 1.3.x Exploit Author: KaBuS alertdocument.cookie;alert/xss/; Text: alertdocument.cookie;alert/xss/; Name or nick: alertdocument.cookie;alert/xss/; e-mail: alertdocument.cookie;alert/xss/; send. and refresh page .. Attack 2 : http://site/path/?page=vdasCMS New Commen...
CVE-2007-1797
Multiple integer overflows in ImageMagick before 6.3.3-5 allow remote attackers to execute arbitrary code via 1 a crafted DCM image, which results in a heap-based overflow in the ReadDCMImage function, or 2 the a colors or b comments field in a crafted XWD image, which results in a heap-based...
Mephisto blog is vulnerable to XSS
Hello everyone! Current bleeding-edge version of Mephisto blog is vulnerable to XSS. Comment's author name accept javascript code. If admin approves/ rejects comments manually, he have to load all unapproved comments, so it's possible to fetch his session id. Example Add new comment with the...
Wordpress <= v2.1.0
If you're logged in into wordpress as an admin, your comments aren't properly sanitized, thus allowing an XSS to be posted. This can be exploited using XSRF techniques. More info & PoC: http://www.virtuax.be/advisories/Advisory4-20022007.txt...
CVE-2007-1176
Multiple cross-site scripting XSS vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 Gallery Comments pages, 2 Feedback pages, 3 Search Results pages, and 4 the Statistics Log viewer...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 Gallery Comments pages, 2 Feedback pages, 3 Search Results pages, and 4 the Statistics Log viewer...
CVE-2007-1176
Multiple cross-site scripting XSS vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 Gallery Comments pages, 2 Feedback pages, 3 Search Results pages, and 4 the Statistics Log viewer...
CVE-2007-1176
Multiple cross-site scripting XSS vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 Gallery Comments pages, 2 Feedback pages, 3 Search Results pages, and 4 the Statistics Log viewer...
CVE-2007-1176: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 Gallery Comments pages, 2 Feedback pages, 3 Search Results pages, and 4 the Statistics Log viewer...
Mandrake Linux Security Advisory : kdelibs (MDKSA-2007:031)
Konqueror 3.5.5 does not properly parse HTML comments in title tags, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment, a related issue to CVE-2007-0478. Updated packages have been patch...
Drupal < 4.7.6 (post comments) Remote Command Execution Exploit v2
No description provided by source. !/usr/bin/perl $Id: milw0rmdrupalv4.pl,v 0.2 2007/02/15 13:28:29 str0ke Exp $ milw0rmdrupalv4.pl - Drupal 4.7.6 Remote Command Execution Exploit Copyright c 2007 str0ke str0ke!milw0rm.com Description ----------- Previews on comments were not passed through norma...
Sql injection
SQL injection vulnerability in comments.php in LushiNews 1.01 and earlier allows remote authenticated users to inject arbitrary SQL commands via the id parameter...
Unfixed XSS vulnerability at www.lovelyparty.co.uk
Security researcher x2Fusion, has submitted on 02/09/2007 a cross-site-scripting XSS vulnerability affecting www.lovelyparty.co.uk, which at the time of submission ranked 6115330 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/09/2007. It is...
USN-420-1: KDE library vulnerability
Jose Avila III and Robert Tasarz discovered that the KDE HTML library did not correctly parse HTML comments inside the "title" tag. By tricking a Konqueror user into visiting a malicious website, an attacker could bypass cross-site scripting protections...
DEBIAN-CVE-2007-0541
WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain...
Cross site scripting
The KDE HTML library kdelibs, as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to...