Bitweaver 2.6 - 'saveFeed()' Remote Code Execution

saveFeed $rssversionname, $cacheFile ; ... it calls saveFeed function in an insecure way, arguments are built on $REQUESTversion var and may contain directory traversal sequences... now look at saveFeed function in /rss/feedcreator.class.php ... function saveFeed$filename="", $displayContents=tru...

PT-2008-6645 · Projectpier · Projectpier

Name of the Vulnerable Software and Affected Versions: ProjectPier versions 0.8 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML via various means, including a message, a milestone, or a display name in a profile, or the a or c parameter to...

projectpier-xssxsrf.txt

====================================================================== ProjectPier Impact: Cross Site Scripting Cross Site Request Forgery Status: patch available ------------------------------ Affected software description: ------------------------------ Application: ProjectPier Version: = 0.80...

blogspot.txt

Blogspot.com Homepage: http://www.blogspot.com Affected files: Blog input boxes ------------------------------------------ XSS vuln via Display name input box. Blogger doesnt properally sanatize user input before generating it. For example, you can't use illegal characters in your username,or...

Cross site scripting

Cross-site scripting XSS vulnerability in Website Baker CMS before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a user display name...

CVE-2006-2307

Cross-site scripting XSS vulnerability in Website Baker CMS before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a user display name...

CVE-2006-2307

Cross-site scripting XSS vulnerability in Website Baker CMS before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a user display name...

Дырка в kvt

Ошибка форматной строки при разборе имени дисплея...

kvt format bug

kdebase-1.1.2 xsetup.c:229 displayname = getenv"DISPLAY"; command.c:1720 extern char displayname; command.c:1840 cprintfdisplayname; command.c:1464 void cprintfunsigned char fmt,... Patch attached. -- Carlos E Gorges [email protected] Tech informбtica LTDA Brazil...

Дырка в xlock/xlockmore

Ошибка форматной строки в имени дисплея. На некоторых системах xlock установлен как suid...

Update Rollup 5 for System Center 2016 Orchestrator

None None...