Design/Logic Flaw

Apple Safari for Windows 3.0.3 and earlier does not prompt the user before downloading a file, which allows remote attackers to download arbitrary files to the desktop of a client system via certain HTML, as demonstrated by a filename in the DATA attribute of an OBJECT element. NOTE: it could be...

CVE-2007-4424: Undefined Security Weakness

Apple Safari for Windows 3.0.3 and earlier does not prompt the user before downloading a file, which allows remote attackers to download arbitrary files to the desktop of a client system via certain HTML, as demonstrated by a filename in the DATA attribute of an OBJECT element. NOTE: it could be...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Search Module in PHP-Nuke allow remote attackers to inject arbitrary web script or HTML via a trailing "" in 1 the onerror attribute of an IMG element, 2 the onload attribute of an IFRAME element, or 3 redirect users to other sites via the...

asa-2007-015.rb.txt

!/usr/bin/env ruby author = tenkeiev Script to test chaniax for the vuln in ASA-2007-015 Trigger subtypes of 11 or 12 will crash an unpatched server First establish a call - send new, recv accept, send ack, recv answer, send ack Then send IAX2 control packets with subtypes 0x0b or 0x0c that conta...

security flaw

Mozilla Firefox before 2.0.0.5 allows remote attackers to execute arbitrary code with chrome privileges by calling an event handler from an unspecified "element outside of a document."...

Mozilla Foundation Security Advisory 2007-21

Mozilla Foundation Security Advisory 2007-21 Title: Privilege escallation using an event handler attached to an element not in the document Impact: Critical Announced: July 17, 2007 Reporter: mozbugra4 Products: Firefox Fixed in: Firefox 2.0.0.5 Description An attecker can use an element outside ...

Cross site scripting

Cross-site scripting XSS vulnerability in default.asp in Element CMS allows remote attackers to inject arbitrary web script or HTML via the s parameter in a search pID action...

CVE-2007-3886

Cross-site scripting XSS vulnerability in default.asp in Element CMS allows remote attackers to inject arbitrary web script or HTML via the s parameter in a search pID action...

CVE-2007-3886

Cross-site scripting XSS vulnerability in default.asp in Element CMS allows remote attackers to inject arbitrary web script or HTML via the s parameter in a search pID action...

CVE-2007-3886

The vulnerability CVE-2007-3886 affects Element CMS, specifically the default.asp script. An XSS flaw exists when exploiting the s parameter in a search pID action, allowing remote attackers to inject arbitrary web script or HTML. No remediation details are provided in the supplied documents.

CVE-2007-3886: Undefined Security Weakness

Cross-site scripting XSS vulnerability in default.asp in Element CMS allows remote attackers to inject arbitrary web script or HTML via the s parameter in a search pID action...

Cross site scripting

Cross-site scripting XSS vulnerability in takeprofedit.php in TBDev.NET DR 11-10-05-BETA-SF1:111005 and earlier allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of a SCRIPT element in the avatar parameter. NOTE: this may be related to the tracker program in the...

TISA2007-06-Public.txt

========================================================================= TeamIntell Security Advisory TISA2007-06-Public ------------------------------------------------------------------------- Element CMS "s" parameter script insertion vulnerability...

[Full-disclosure] Element CMS script insertion vulnerability

========================================================================= TeamIntell Security Advisory TISA2007-06-Public ------------------------------------------------------------------------- Element CMS "s" parameter script insertion vulnerability...

CVE-2007-3579: Undefined Security Weakness

PHPIDS before 20070703 does not properly handle setting the .text property of a SCRIPT element before its attachment to the DOM, which allows remote attackers to inject arbitrary web script...

CVE-2007-3342

Multiple cross-site scripting XSS vulnerabilities in Movable Type MT before 3.34 allow remote attackers to inject arbitrary web script or HTML via comments that have 1 a malformed SGML numeric character reference with a '\0' 0x00 character in a javascript: URI or 2 an attribute in an element that...

CVE-2007-3244

SQL injection vulnerability in bb-includes/formatting-functions.php in bbPress before 0.8.1 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors to forums/bb-edit.php, as demonstrated by a PRE element, aka the "quircky slashes bug."...

Buffer overflow

Buffer overflow in the wireless driver 6.0.0.18 for D-Link DWL-G650+ Rev. A1 on Windows XP allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a beacon frame with a long TIM Information Element...

CVE-2007-0933

Buffer overflow in the wireless driver 6.0.0.18 for D-Link DWL-G650+ Rev. A1 on Windows XP allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a beacon frame with a long TIM Information Element...

CVE-2007-0933

Buffer overflow in the wireless driver 6.0.0.18 for D-Link DWL-G650+ Rev. A1 on Windows XP allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a beacon frame with a long TIM Information Element...