[SECURITY] [DSA 1534-1] New iceape packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1534-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 28, 2008 http://www.debian.org/security/faq -...

DSA-1534-1 iceape

Bulletin has no description...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : firefox vulnerabilities (USN-592-1)

Alexey Proskuryakov, Yosuke Hasegawa and Simon Montagu discovered flaws in Firefox's character encoding handling. If a user were tricked into opening a malicious web page, an attacker could perform cross-site scripting attacks. CVE-2008-0416 Various flaws were discovered in the JavaScript engine...

[SECURITY] [DSA 1532-1] New xulrunner packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1532-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 27, 2008 http://www.debian.org/security/faq -...

DSA-1532-1 xulrunner

Bulletin has no description...

Mozilla Foundation Security Advisory 2008-16

Mozilla Foundation Security Advisory 2008-16 Title: HTTP Referrer spoofing with malformed URLs Impact: Moderate Announced: March 25, 2008 Reporter: Gregory Fleischer, RSnake Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.13 SeaMonkey 1.1.9 Description Security researcher Gregory Fleischer...

mozilla -- multiple vulnerabilities

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program. MFSA 2008-19 XUL popup spoofing variant cross-tab popups MFSA 2008-18 Java sock...

HTTP Referrer spoofing with malformed URLs — Mozilla

Security researcher Gregory Fleischer demonstrated a problem with the HTTP Referer: sic header sent with requests to URLs containing Basic Authentication credentials with empty usernames. In these cases a number of leading characters, based on the length of the password in the URL, are removed fr...

wppersist-xss.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 1. DESCRIPTION OF THE SOFTWARE On May 6th, 2007 a new WordPress plugin called "stats" was released. This plugin allows a WordPress user who has his blog self-hosted to use the Wordpress.com statistics. The plugin includes a JavaScript on the blog page...

Persistent cross-site scripting in wordpress.com dashboard

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 1. DESCRIPTION OF THE SOFTWARE On May 6th, 2007 a new WordPress plugin called "stats" was released. This plugin allows a WordPress user who has his blog self-hosted to use the Wordpress.com statistics. The plugin includes a JavaScript on the blog page...

PMachine ExpressionEngine 1.4.1 - HTTP Referrer HTML Injection

source: https://www.securityfocus.com/bid/16377/info ExpressionEngine is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to HTTP 'Referer' header before using it in dynamically generated content. Attacker-supplie...

CVE-2005-1527

Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call...

CVE-2005-1527

AWStats 6.4 and earlier are affected by an eval() injection when a URLPlugin is enabled, allowing remote attackers to execute arbitrary Perl code via the HTTP Referrer taint passed into an eval call. The issue is triggered by user-supplied data being evaluated, enabling remote code execution with...

CVE-2005-1527

Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call...

CVE-2005-1527

Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call...

CVE-2005-1527: Improper Control of Generation of Code

Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call...

CVE-2001-1545

Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests a.k.a. rewriting when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing...

CVE-2001-1545: Undefined Security Weakness

Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests a.k.a. rewriting when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing...

PHP-Nuke MS-Analysis Module - HTTP Referrer Field SQL Injection

source: https://www.securityfocus.com/bid/9948/info Reportedly the MS-Analysis module is prone to a remote SQL injection vulnerability. This issue is due to a failure to properly sanitize user supplied HTTP header input before using it in an SQL query. As a result of this, a malicious user may...

CVE-2003-0405

Vignette StoryServer 5 and Vignette V/6 allows remote attackers to execute arbitrary TCL code via 1 an HTTP query or cookie which is processed in the NEEDS command, or 2 an HTTP Referrer that is processed in the VALIDPATHS command...