Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Fatwire Content Server CS CMS 6.3.0 allow remote attackers to inject arbitrary web script or HTML via unspecified form fields related to the 1 search function, 2 advanced search function, and possibly other components...

Microsoft Internet Explorer 5.0.1 - Arbitrary File Upload

source: https://www.securityfocus.com/bid/25836/info Microsoft Internet Explorer is prone to an information-disclosure vulnerability that allows attackers to gain access to the contents of arbitrary files. This issue stems from a design error resulting from the improper handling of form fields...

CVE-2007-3672

Cross-site scripting XSS vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the blogroll page...

CVE-2007-3672

Cross-site scripting XSS vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the blogroll page...

Design/Logic Flaw

corefoundation.dll in Apple Safari 3.0.1 552.12.2 for Windows allows remote attackers to cause a denial of service crash via certain forms that trigger errors related to History, possibly involving multiple form fields with the same name...

CVE-2007-3284

corefoundation.dll in Apple Safari 3.0.1 552.12.2 for Windows allows remote attackers to cause a denial of service crash via certain forms that trigger errors related to History, possibly involving multiple form fields with the same name...

Cross site scripting

Cross-site scripting XSS vulnerability in DevTrack 6.x allows remote attackers to inject arbitrary web script or HTML via the "Keyword search" form field and unspecified other form fields that populate a public saved query. NOTE: the provenance of this information is unknown; the details are...

CVE-2006-6588

The forum implementation in the ecommerce component in the Apache Open For Business Project OFBiz trusts the 1 dataResourceTypeId, 2 contentTypeId, and certain other hidden form fields, which allows remote attackers to create unauthorized types of content, modify content, or have other unknown...

Tons of SQL-injections and XSS in Eichhorn Portal and vendor page

Hi list. There are lots of SQL injections and XSS in the 'Eichhorn Portal' by 'Guder und Koch Netzwerktechnik' and their own website. Input passed to multiple parameters in different PHP-files isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary...

CVE-2006-3398

The "change password forms" in Taskjitsu before 2.0.1 includes password hashes in hidden form fields, which allows remote attackers to obtain sensitive information from the 1 Category Editor and 2 User Information editor...

[Full-disclosure] [scip_Advisory 2351] Kyberna AG ky2help various form fields SQL Injection

Kyberna AG ky2help various form fields SQL Injection scip AG Vulnerability ID 2351 07/04/2005 http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2351 I. INTRODUCTION Kyberna ky2help is a commercial solution for a web-based ticketing and support system. Users are able to send tickets and those are...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities submit.asp in ASPScriptz Guest Book 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 GBOOKUNAME, 2 GBOOKEMAIL, 3 GBOOKCITY, 4 GBOOKCOU, 5 GBOOKWWW, and 6 GBOOKMESS form fields...

CVE-2006-2882

Multiple cross-site scripting XSS vulnerabilities submit.asp in ASPScriptz Guest Book 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 GBOOKUNAME, 2 GBOOKEMAIL, 3 GBOOKCITY, 4 GBOOKCOU, 5 GBOOKWWW, and 6 GBOOKMESS form fields...

evoBlog Remote Name tag Script injection

DESCRIPTION evoBlog is prone to HTML injection attacks. It is possible for a malicious evoBlog user to inject hostile HTML and script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of evoBlog. evoBlog does not adequately...

CVE-2006-0044

Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields"...

CVE-2006-0044

Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields"...

Design/Logic Flaw

Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields"...

Zoomblog <IMG> BBCode Tag JavaScript Injection Vulnerability

DETAILS Zoomblog is prone to javascript injection attacks. Zoomblog does not adequately filter img tags from various fields. It is possible for a malicious Zoomblog user to inject hostile javascript code into the commentary via form fields. This code may be rendered in the browser of a web user w...

Zoomblog HTML Injection Vulnerability

DESCRIPTION Zoomblog is prone to HTML injection attacks. It is possible for a malicious Zoomblog user to inject hostile HTML and script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of Zoomblog. Zoomblog does not adequate...

HTTP login page

This script logs onto a web server through a login page and stores the authentication / session cookie. SPDX-FileCopyrightText: 2005 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...