361 matches found
SA-CORE-2009-005 - Drupal core - Cross site scripting
When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input. Certain byte sequences that are valid in the UTF-...
Cross site scripting
Cross-site scripting XSS vulnerability in Services/Utilities/classes/class.ilUtil.php in ILIAS 3.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via attributes inside a domain-name string in the 1 mailing or 2 forum component, as demonstrated using the style and...
CVE-2007-5806
Cross-site scripting XSS vulnerability in Services/Utilities/classes/class.ilUtil.php in ILIAS 3.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via attributes inside a domain-name string in the 1 mailing or 2 forum component, as demonstrated using the style and...
CVE-2007-5806: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Services/Utilities/classes/class.ilUtil.php in ILIAS 3.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via attributes inside a domain-name string in the 1 mailing or 2 forum component, as demonstrated using the style and...
CVE-2007-3891
Unspecified vulnerability in Windows Vista Weather Gadgets in Windows Vista allows remote attackers to execute arbitrary code via crafted HTML attributes...
CVE-2007-3033
Cross-site scripting XSS vulnerability in Windows Vista Feed Headlines Gadget aka Sidebar RSS Feeds Gadget in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zo...
CVE-2007-3033
Cross-site scripting XSS vulnerability in Windows Vista Feed Headlines Gadget aka Sidebar RSS Feeds Gadget in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zo...
CVE-2007-3891
Unspecified vulnerability in Windows Vista Weather Gadgets in Windows Vista allows remote attackers to execute arbitrary code via crafted HTML attributes...
CVE-2007-3033: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Windows Vista Feed Headlines Gadget aka Sidebar RSS Feeds Gadget in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zo...
CVE-2007-3891: Undefined Security Weakness
Unspecified vulnerability in Windows Vista Weather Gadgets in Windows Vista allows remote attackers to execute arbitrary code via crafted HTML attributes...
security flaw
Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 ignores trailing invalid HTML characters in attribute names, which allows remote attackers to bypass content filters that use regular expressions...
Improvements to help protect against Cross-Site Scripting attacks — Mozilla
Firefox 2.0.0.2 and 1.5.0.10 contain several small changes that will make it easier for sites to protect their visitors against Cross-Site Scripting XSS attacks. Invalid trailing characters in HTML tag attributes The Mozilla parser formerly ignored invalid trailing characters in HTML tag attribut...
CVE-2005-1888
Cross-site scripting XSS vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates...
CVE-2005-1888: Undefined Security Weakness
Cross-site scripting XSS vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates...
MediaWiki < 1.3.13 / 1.4.5 / 1.5.0 alpha2 Page Template Inclusions HTML Attributes XSS
According to its self-reported version number, the installation of MediaWiki running on the remote host is affected by a cross-site scripting vulnerability due to a failure to sanitize user-supplied input passed to certain HTML attributes when including a template inside a style directive when...
CVE-2005-1888
Cross-site scripting XSS vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates...
DEBIAN-CVE-2005-1888
Cross-site scripting XSS vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates...
Vilistextum 2.6.6 - HTML Attribute Parsing Buffer Overflow
source: https://www.securityfocus.com/bid/11979/info Vilistextum is prone to a buffer overflow vulnerability. This issue is exposed when the application parses HTML attributes while converting an HTML file to text/ASCII. Since HTML files will likely originate from an external or untrusted source,...
Geeklog 1.3.5 - HTML Attribute Cross-Site Scripting
Geeklog 1.3.5 - HTML Attribute Cross-Site Scripting source: https://www.securityfocus.com/bid/5270/info A cross site scripting vulnerability has been reported for Geeklog. Reportedly, Geeklog does not properly sanitize user supplied input before being included when posting comments or writing...
