CVE-2002-1085

Multiple cross-site scripting vulnerabilities in ezContents 1.41 and earlier allow remote attackers to execute script and steal cookies via the diary and other capabilities...

Michael Schatz Books 0.54/0.6 PostNuke Module - Cross-Site Scripting

source: https://www.securityfocus.com/bid/5882/info Books is a module written for PostNuke. Reportedly, Books is prone to cross site scripting attacks. An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link containing HTML and script code. The...

Jetty 4.1 Servlet Engine - Cross-Site Scripting

source: https://www.securityfocus.com/bid/5821/info Jetty is a freely available, open source Java Web Server and Servlet Container. It is available for Linux, Unix, and Microsoft Windows platforms. It has been reported that Jetty does not properly sanitize requests. This could result in a user...

Slash-based bulletin boards contain a "quick login" feature that may disclose username and password

Overview Slash-based bulletin boards contain a vulnerability that may cause users to disclose their username and password to third-party sites. Description As described in the Slashcode FAQ, "Slash is a database-driven news and message board, using Perl, Apache and MySQL." Slash allows web site...

CVE-2002-1085

Multiple cross-site scripting vulnerabilities in ezContents 1.41 and earlier allow remote attackers to execute script and steal cookies via the diary and other capabilities...

Mozilla Bonsai - Multiple Cross-Site Scripting Vulnerabilities

Mozilla Bonsai - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/5516/info Multiple cross site scripting vulnerabilities have been reported for the Bonsai tool. An attacker may exploit this vulnerability by causing a victim user to follow a malicious link...

CVE-2002-0524

ASP-Nuke RC2 and earlier allows remote attackers to determine the absolute path of the server by 1 calling database-inc.asp with incorrect cookies, or 2 calling Post.asp with certain arguments, which leak the pathname in an error message...

CVE-2002-0486

Intellisol Xpede 4.1 uses weak encryption to store authentication information in cookies, which could allow local users with access to the cookies to gain privileges...

CVE-2002-0756

CVE-2002-0756 is a cross-site scripting vulnerability on the authentication page for Webmin 0.96 and Usermin 0.90. The flaw allows remote attackers to inject scripts into an error page and potentially steal cookies. The NVD record assigns CVSSv2 base score 7.5 (HIGH) with network attack vector an...

CVE-2002-0739

CVE-2002-0739 describes a cross-site scripting vulnerability in PostCalendar 3.02. The issue allows remote attackers to inject arbitrary HTML and scripts and to harvest cookies by modifying a calendar entry on the preview page. The NVD entry lists a base score of 7.5 (HIGH) with network attack ve...

CVE-2002-0117

The CVE-2002-0117 entry concerns YaBB (Yet Another Bulletin Board) 1 Gold SP 1 and earlier, where a cross-site scripting vulnerability allows remote attackers to execute arbitrary script and steal cookies through a message containing encoded Javascript in an IMG tag. Affected component is the YaB...

CVE-2002-0590

Cross-site scripting CSS vulnerability in IcrediBB 1.1 Beta allows remote attackers to execute arbitrary script and steal cookies as other IcrediBB users via the 1 title or 2 body of posts...

CVE-2002-0524

The CVE-2002-0524 entry affects ASP-Nuke RC2 and earlier . The vulnerability arises from error messages that disclose the server’s absolute path when attackers trigger two conditions: (1) calling database-inc.asp with incorrect cookies, or (2) calling Post.asp with certain arguments. This results...

CVE-2002-0590

Cross-site scripting (XSS) in IcrediBB 1.1 Beta allows remote attackers to execute arbitrary script and steal cookies via the title or body of posts. The vulnerability affects the web application’s posting features and stems from improper handling/encoding of user-supplied input. Impact is descri...

[SNS Advisory No.52] Webmin/Usermin Cross-site Scripting Vulnerability

---------------------------------------------------------------------- SNS Advisory No.52 Webmin/Usermin Cross-site Scripting Vulnerability Problem first discovered: Thu, 2 May 2002 Published: Tue, 7 May 2002 ---------------------------------------------------------------------- Overview: -------...

CVE-2002-0319

CVE-2002-0319 describes a cross-site scripting vulnerability in edituser.php for pforum versions 1.14 and earlier. The issue allows remote attackers to inject JavaScript via the username, enabling them to execute script and potentially steal cookies from other users. Affected component: pforum’s ...

CVE-2002-0319

Cross-site scripting vulnerability in edituser.php for pforum 1.14 and earlier allows remote attackers to execute script and steal cookies from other users via Javascript in a username...

squirrelmail 1.2.5 email user can execute command

email user can append $THEME variable through cookies ---------------- start sq125x --------------------- !/bin/bash squirrelmail-1.2.5 remote execution by pokleyzz http://www.inetd-secure.net usage : ./sq125x themecount username password url command example : ./sq125x 2 pokley 123456...

CVE-2002-0118

Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board UBB 6.2.0 Beta Release 1.0 allows remote attackers to execute arbitrary script and steal cookies via a message containing encoded Javascript in an IMG tag...

WorkforceROI Xpede 4.17.0 - Weak Password Encryption

WorkforceROI Xpede 4.17.0 - Weak Password Encryption source: https://www.securityfocus.com/bid/4344/info An issue has been reported in Xpede, which could lead to a compromise of user authentication information. Reportedly, Xpede cookies containing username and password data is stored using a weak...