IOS HTTP Server Command Injection Vulnerability

A vulnerability exists in the IOS HTTP server in which HTML code inserted into dynamically-generated output, such as the output from a show buffers command, will be passed to the browser requesting the page. This HTML code could be interpreted by the client browser and potentially execute malicio...

Hulihan Applications Amethyst 0.1.5 - Multiple HTML Injection Vulnerabilities

Hulihan Applications Amethyst 0.1.5 - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/42253/info Hulihan Applications Amethyst is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using ...

Muraus Open Blog - Multiple HTML Injection Vulnerabilities

Muraus Open Blog - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/42255/info Tomaž Muraus Open Blog is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generat...

Impact Software AdPeeps - Cross-Site Scripting HTML Injection

Impact Software AdPeeps - Cross-Site Scripting HTML Injection source: https://www.securityfocus.com/bid/42071/info Impact Software Ad Peeps is prone to multiple cross-site scripting vulnerabilities and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied inp...

BoastMachine 3.1 - key Cross-Site Scripting

BoastMachine 3.1 - key Cross-Site Scripting source: https://www.securityfocus.com/bid/40623/info boastMachine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage this...

Microsoft IIS WebDAV Request Source Code Disclosure

The Internet Information Server IIS is a collection of Internet services packaged with several versions of the Windows operating system. IIS includes a Web server service that is capable of serving static, as well as dynamic content. The Web server is equipped with the Active Server Pages ASP...

Curverider Elgg 1.0 - Templates HTML Injection

Curverider Elgg 1.0 - Templates HTML Injection source: https://www.securityfocus.com/bid/43871/info Elgg is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Exploits require the attacker be an...

[SECURITY] Fedora 10 Update: jetty-5.1.15-3.fc10

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in order to use java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

[SECURITY] Fedora 11 Update: jetty-5.1.15-4.fc11

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in order to use java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

[SECURITY] Fedora 9 Update: jetty-5.1.15-3.fc9

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in order to use java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

[SECURITY] Fedora 9 Update: jetty-5.1.14-1jpp.2.fc9

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in order to use java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

Barracuda Spam Firewall cgi-bin/ldap_test.cgi email Parameter XSS

According to its firmware version, the remote Barracuda Spam Firewall device fails to filter input to the 'email' parameter of the '/cgi-bin/ldaptest.cgi' script before using it to generate dynamic content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary...

Sun Java System Web Server Search Module XSS

The remote host is running Sun Java System Web Server, a Java application for user provisioning and identity auditing in enterprise environments. The version of Sun Java System Web Server installed on the remote host fails to sanitize user-supplied input to its Search module before using it to...

SNewsCMS 2.x - 'search.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/28262/info SNewsCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage this issue to execute arbitrary script code in the...

Sun Java System Identity Manager Multiple XSS

The remote host is running Sun Java System Identity Manager, a Java application for user provisioning and identity auditing in enterprise environments. The version of Identity Manager installed on the remote host fails to sanitize user-supplied input to various JSP scripts before using it to...

Mort Bay Jetty Dump Servlet (webapps/test/jsp/dump.jsp) XSS

The remote instance of Mort Bay Jetty includes a test servlet, 'webapps/test/jsp/dump.jsp', that fails to sanitize user-supplied input before using it to generate dynamic content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a...

SNewsCMS 2.1 - News_page.php Cross-Site Scripting

SNewsCMS 2.1 - Newspage.php Cross-Site Scripting source: https://www.securityfocus.com/bid/25963/info SNewsCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage this...

IT!CMS 0.2 - 'lang-en.php?wndtitle' Cross-Site Scripting

source: https://www.securityfocus.com/bid/25129/info IT!CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary script code ...

Nullsoft SHOUTcast 1.9.7 - Logfile HTML Injection

source: https://www.securityfocus.com/bid/22742/info Nullsoft SHOUTcast is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of the...

Sage 1.3.6 - Extension Feed HTML Injection

Sage 1.3.6 - Extension Feed HTML Injection source: https://www.securityfocus.com/bid/22493/info Sage Extension Feed is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Hostile HTML and...