4137 matches found
CVE-2006-0044
Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields"...
Design/Logic Flaw
Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields"...
CVE-2006-0044
Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields"...
CVE-2006-0044: Undefined Security Weakness
Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields"...
Zoomblog HTML Injection Vulnerability
DESCRIPTION Zoomblog is prone to HTML injection attacks. It is possible for a malicious Zoomblog user to inject hostile HTML and script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of Zoomblog. Zoomblog does not adequate...
Zoomblog <IMG> BBCode Tag JavaScript Injection Vulnerability
DETAILS Zoomblog is prone to javascript injection attacks. Zoomblog does not adequately filter img tags from various fields. It is possible for a malicious Zoomblog user to inject hostile javascript code into the commentary via form fields. This code may be rendered in the browser of a web user w...
HTTP login page
This script logs onto a web server through a login page and stores the authentication / session cookie. SPDX-FileCopyrightText: 2005 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
sparkleBlogXSS.txt
SparkleBlog is prone to HTMl injection attacks. It is possible for a malicious SparkleBlog user to inject hostile HTML script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of SparkleBlog. SparkleBlog does not adequately...
SparkleBlog Journal.php HTML Injection Vulnerability =>v2.1 (all versions vulnerable)
SparkleBlog is prone to HTMl injection attacks. It is possible for a malicious SparkleBlog user to inject hostile HTML script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of SparkleBlog. SparkleBlog does not adequately...
CVE-2005-3103
Summary: CVE-2005-3103 is an XSS vulnerability in Movable Type prior to 3.2. The issue allows remote attackers to inject arbitrary web script or HTML via multiple form fields (title, category, body, extended body, excerpt) when creating new blog entries. The provided description notes it as a cro...
CVE-2004-2330
ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fields...
CVE-2004-2330: Undefined Security Weakness
ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fields...
CVE-2005-2428
Lotus Domino R5/R6 WebMail with Generate HTML for all fields enabled can reveal sensitive data via names.nsf hidden fields. The connected nuclei template documents information disclosure: password hashes in HTTPPassword, password-change date in HTTPPasswordChangeDate, and client release in ClntBl...
CVE-2005-2428: Undefined Security Weakness
Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as 1 the password hash in the HTTPPassword field, 2 the password chan...
CVE-2002-1868
Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields...
CVE-2002-1868: Undefined Security Weakness
Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields...
CVE-2003-1212
MaxWebPortal 1.30 allows remote attackers to perform unauthorized actions by modifying hidden form fields, such as the 1 news, 2 lock, or 3 allmem fields in the 'start new topic' HTML page...
CVE-2003-1212: Undefined Security Weakness
MaxWebPortal 1.30 allows remote attackers to perform unauthorized actions by modifying hidden form fields, such as the 1 news, 2 lock, or 3 allmem fields in the 'start new topic' HTML page...
CVE-2004-2058
CVE-2004-2058 affects ASPrunner 2.4, where a remote attacker can disclose sensitive information via (1) hidden form fields or (2) error messages. The core description in the CVE entry is that ASPRunner 2.4 allows information disclosure to unauthenticated remote actors. Connected documents corrobo...