Unfixed XSS vulnerability at game1059.de

Security researcher THE-SH0CK-B0Y, has submitted on 02/07/2007 a cross-site-scripting XSS vulnerability affecting game1059.de, which at the time of submission ranked 208302 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 03/07/2007. It is...

cold-xss.txt

Title: Cold Fusion Web Server XSS 0 day Own3d by: digi7al64 thx: WhiteAcid About: Default settings in Cold Fusion server ensure it returns a standardized error page whenever a exception occurs 404,500 etc. This page then echos the user agent, ip and referer back to the user for debugging purposes...

Cold Fusion Web Server XSS 0 day

Title: Cold Fusion Web Server XSS 0 day Own3d by: digi7al64 thx: WhiteAcid About: Default settings in Cold Fusion server ensure it returns a standardized error page whenever a exception occurs 404,500 etc. This page then echos the user agent, ip and referer back to the user for debugging purposes...

ISAA-2006-010.txt

============================================= INTERNET SECURITY AUDITORS ALERT 2006-010 - Original release date: September 28, 2006 - Last revised: December 1, 2006 - Discovered by: Vicente Aguilera Diaz - Severity: 3/5 ============================================= I. VULNERABILITY...

CVE-2006-4726

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a ColdFusion error page...

CVE-2006-4199

Cross-site scripting XSS vulnerability in Soft3304 04WebServer 1.83 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly sanitized before it is returned in an error page, a different vulnerability than CVE-2004-1512...

CVE-2006-4067

Cross-site scripting XSS vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 "Not Found" error page. NOTE: some of these details are obtained from third party information...

CVE-2006-4067

The CVE-2006-4067 issue affects CakePHP, specifically the cake/libs/error.php component, where an XSS vulnerability allows an attacker to inject arbitrary script/HTML via the URL. The problem is reflected in a 404 page and arises in CakePHP before version 1.1.7.3363. Connected advisories corrobor...

CVE-2006-4067

Cross-site scripting XSS vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 "Not Found" error page. NOTE: some of these details are obtained from third party information...

Sun ONE and Sun Java System Applications vulnerable to cross-site scripting via default error page

Overview A cross-site scripting vulnerability in Sun ONE and Sun Java System Applications may allow an attacker to read or modify data in web pages and cookies. Description From Sun Alert Notification 102164: A Cross Site Scripting XSS vulnerability in various releases of the Sun Java System Web...

CVE-2006-3358

Multiple cross-site scripting XSS vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via the 1 words, 2 id, 3 catid, and 4 tim parameters, which are not sanitized before being returned in an error page. NOTE: it is possible that some of...

CVE-2006-3338

Cross-site scripting XSS vulnerability in Atlassian JIRA 3.6.2-156 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a direct request to secure/ConfigureReleaseNote.jspa, which are not sanitized before being returned in an error page...

Cross site scripting

Cross-site scripting XSS vulnerability in BlueDragon Server and Server JX 6.2.1.286 for Windows allows remote attackers to inject arbitrary web script or HTML via the filename in a request to a 1 .cfm or 2 .cfml file, which reflects the result in the default error page...

CVE-2006-2311

Cross-site scripting XSS vulnerability in BlueDragon Server and Server JX 6.2.1.286 for Windows allows remote attackers to inject arbitrary web script or HTML via the filename in a request to a 1 .cfm or 2 .cfml file, which reflects the result in the default error page...

CVE-2006-2311

Cross-site scripting XSS vulnerability in BlueDragon Server and Server JX 6.2.1.286 for Windows allows remote attackers to inject arbitrary web script or HTML via the filename in a request to a 1 .cfm or 2 .cfml file, which reflects the result in the default error page...

BlueDragon 6.2.1 Multiple Remote Vulnerabilities (XSS, DoS)

The remote host is running BlueDragon Server / Server JX, Java-based servers for stand-alone deployment of CFML ColdFusion Markup Language pages. The version of BlueDragon Server / Server JX installed on the remote host fails to sanitize user-supplied input passed as part of the filename before...

CVE-2006-3044

Cross-site scripting XSS vulnerability in LogiSphere 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected in an error page...

CVE-2005-4682

Cross-site scripting XSS vulnerability in error.asp in AudienceView allows remote attackers to inject arbitrary web script or HTML via the TSerrorMessage parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2005-3357

modssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service application crash via a non-SSL request to an SSL port, which triggers a NULL pointer dereference...

security flaw

modssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service application crash via a non-SSL request to an SSL port, which triggers a NULL pointer dereference...