Apache Httpd < 2.0.65 : error responses can expose cookies

A flaw was found in the default error response for status code 400. This flaw could be used by an attacker to expose "httpOnly" cookies when no custom ErrorDocument is specified...

MailEnable Webmail Cross Site Scripting

ME020567: MailEnable webmail cross-site scripting vulnerability CWE-79 References: CVE-2012-0389 Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 Vendor contact: 2012-01-04 09:49:36 UTC Vendor...

MailEnable Webmail - Cross-Site Scripting

MailEnable Webmail - Cross-Site Scripting ME020567: MailEnable webmail cross-site scripting vulnerability CWE-79 References: CVE-2012-0389 Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 Vendor...

Bundesregierung Website - Cross Site Scripting Vulnerability

Document Title: =============== Bundesregierung Website - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=346 Release Date: ============= 2011-12-21 Vulnerability Laboratory ID VL-ID: ===================================...

Microsoft Forefront UAG Default Reflected Cross-site Scripting (MS11-079; CVE-2011-1897)

A cross-site scripting vulnerability has been reported in Microsoft Forefront Unified Access Gateway UAG server. The vulnerability is due to an error in the way the UAG server handles incoming HTTP query strings. A remote attacker could exploit this issue by enticing a user to open a URL containi...

CVE-2011-4849

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php a...

PHPSou open-source search system of 0Day-vulnerability warning-the black bar safety net

Go from tools, author: yizhigu The reprint must be famous copyrights! 1 vulnerability description Is an open source search engine system, the official forum is: www.phpsou.net,simple introduction is as follows: PHPSou vertical search engine using PHP+Mysql development, is domestic first based on...

FreeBSD : opera -- multiple vulnerabilities (a4a809d8-25c8-11e1-b531-00215c6a37bb) (BEAST)

Opera software reports : - Fixed a moderately severe issue; details will be disclosed at a later date - Fixed an issue that could allow pages to set cookies or communicate cross-site for some top level domains; see our advisory - Improved handling of certificate revocation corner cases - Added a...

Aspcms 1.5 COOKIES injection 0day and fix-vulnerability warning-the black bar safety net

Aspcms 1.5 COOKIES injection 0day, register an account. Then after landing to modify the COOKIES of USERID values In the back plus the injected statement: UNION SELECT 1,2,3,4,5,6,username,adminpassword,9,1 0,1 1,1 2,1 3,1 4,1 5,1 6,1 7,1 8,1 9,2 0,2 1,2 2 from Aspcmsadmins Then edit the account...

opera -- multiple vulnerabilities

Opera software reports: Fixed a moderately severe issue; details will be disclosed at a later date Fixed an issue that could allow pages to set cookies or communicate cross-site for some top level domains; see our advisory Improved handling of certificate revocation corner cases Added a fix for a...

OrangeHRM 2.6.11 - index.php Multiple Cross-Site Scripting Vulnerabilities

OrangeHRM 2.6.11 - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/50857/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based...

Chromium, V8: Multiple vulnerabilities

Background Chromium is an open-source web browser project. V8 is Google's open source JavaScript engine. Description Multiple vulnerabilities have been discovered in Chromium and V8. Please review the CVE identifiers and release notes referenced below for details. Impact A local attacker could ga...

Online Subtitles Workshop - Cross-Site Scripting

Online Subtitles Workshop - Cross-Site Scripting =================================================================================== Online Subtitles Workshop XSS vulnerabilities =================================================================================== Exploit Title: Online Subtitles...

CVE-2011-3887

Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified vectors...

CVE-2011-3887

Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in KENT-WEB WEB FORUM 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to cookies...

CVE-2011-3983

Cross-site scripting XSS vulnerability in KENT-WEB WEB FORUM 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to cookies...

'Good to Know' campaign : Google Collaborates with Citizens Advice Bureau for Online Safety

'Good to Know' campaign : Google Collaborates with Citizens Advice Bureau for Online Safety Google's first ever advertising campaign for online safety launches today, in association with the Citizens Advice Bureau. It covers topics such as choosing a password, scam emails and using two factor...

Apple Safari WebKit Private Browsing模式Cookie限制绕过漏洞

CVE ID: CVE-2011-3242 Safari是苹果计算机的最新作业系统Mac OS X中的浏览器，使用了KDE的KHTML作为浏览器的运算核心。 Safari在Private Browsing模式中处理cookie时存在逻辑错误，即使"Block cookies"设置为“Always”也会设置cookie。 Apple Mac OS X 10.6.8 Apple Mac OS X Server v10.6.8 Apple OS X Lion 10.7.2 Apple OS X Lion Server 10.7.2 厂商补丁： Apple -----...

Dominant Creature BBG/RPG Browser Game Cross Site Scripting

=================================================================================== Dominant Creature BBG/RPG browser game XSS vulnerabilities =================================================================================== Exploit Title: Dominant Creature BBG/RPG browser game XSS...