285 matches found
ReBB 1.0 Image Tag Cross-Agent Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4220/info ReBB is web forum software which will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. It is written in PHP and may be back-ended by a number of databases. ReBB allows users t...
XMB Forum 1.6 pre-beta Image Tag Script Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4167/info The Extreme Message Board XMB 1.6 Magic Lantern pre-beta version reportedly allows JavaScript and HTML to be entered in messages. This can be achieved by entering script or HTML between img and /img tags in a...
External image sources can trigger a basic authentication dialogue
When an external resourcee.g. http://foo.com/image.jpeg is used as the source of an image tag, if the external resource returns a 401 response code and sets a WWW-Authenticate header then the browsers standard 'Basic authentication' dialogue will pop up within on the confluence page. While this i...
Atlassian Confluence 3.0 Cross Site Request Forgery
Product: Confluence Vendor: Atlassian Version: 3.0 / Current Tested Version: 3.4.6 Vendor Notified Date: June 31, 2011 Release Date: September 19, 2012 Risk: Medium Authentication: Depends on configuration. Remote: Yes Description: Multiple Cross-Site Request Forgery CSRF vulnerabilities in...
D-Link WBR-1310 - Authentication Bypass
Exploit Title: D-Link WBR-1310 Authentication Bypass Vulnerability Shodan Dork: Embedded HTTP Server 2.00 Date: 22-Dec-2010 Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dlink.com/products/?pid=474 Version: 2.00 Tested on: WBR-1301, firmware version 2.00 The CGI scripts in the D-Lin...
Angel LMS 7.3 Cross Site Scripting
I have discovered a security exploit in Angel LMS 7.3 "Colleges and universities worldwide choose the ANGEL LMS to deliver powerful online teaching and learning experiences. ANGEL provides the comprehensive LMS features institutions need in a simple interface that promotes adoption. A recognized...
CVE-2009-2217
Cross-site scripting XSS vulnerability in NBBC before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via an invalid URL in a BBCode img tag...
Coppermine Photo Gallery 1.4.20 Privilege Escalation
+--------------------------------------------------------------------------+ | Coppermine Photo Gallery = 1.4.20 BBCode IMG Privilege Escalation PoC | +--------------------------------------------------------------------------+ | by Juri Gianni aka yeat - stakerathotmaildotit | |...
CVE-2008-4571
Cross-site scripting XSS vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag...
IntelliTamper 2.07 (imgsrc) Remote Buffer Overflow Exploit
No description provided by source. / IntelliTamper 2.07 imgsrc Remote Buffer Overflow Expoit Discovered & Written by r0ut3r writ3r at gmail.com Many Thanks to Luigi Auriemma http://aluigi.org Greets to shinnai http://www.shinnai.net and Guido Landi IntelliTamper contains a remote buffer overflow...
XSS using onerror
We had a user enter a viagra ad that actual redirected to their site. I think the offending code was here: although obviously they didn't use example.com I've attached the whole page for examination...
XSS using onerror
We had a user enter a viagra ad that actual redirected to their site. I think the offending code was here: although obviously they didn't use example.com I've attached the whole page for examination...
w3m Vulnerability of Unauthorized Access to Files or Cookies
Overview w3m fails to properly escape HTML tags in the ALT attribute of an IMG tag, which could allow an attacker to access files or cookies. Impact An remote attacker could access files and cookies. Solution Please refer to the 'Vendor Information' section for official remediation and take...
Opera 9.50 beta and prior remote DoS (freeze)
Name : Opera 9.50 beta / 9.24 Remote DoS Type : Remote DoS Credits: Gynvael Coldwind of Vexillium & Simey Impact : Low Short description Opera is vulnerable to a remote DoS attack, using spacially crafted BMP files, that causes the browser to freeze for a short amount of time around 4 minutes on...
security flaw
A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an 1 img, 2 link, or 3 style tag, which...
PT-2006-1155 · Drupal · Drupal
Name of the Vulnerable Software and Affected Versions: Drupal versions prior to 4.5.6 Drupal versions prior to 4.6.4 when "Filtered HTML" is not enabled Description: The issue allows remote attackers to conduct cross-site scripting XSS attacks via an IMG tag with an unusual encoded Javascript...
PT-2005-2651 · Help Center Live · Help Center Live
Name of the Vulnerable Software and Affected Versions: Help Center Live affected versions not specified Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This allows remote attackers to perform actions as the administrator via a link or IMG tag to "view.php"...
CVE-2004-1967
Open Bulletin Board (OpenBB) 1.0.6 and earlier contains CSRF vulnerabilities in cp_forums.php, cp_usergroup.php, cp_ipbans.php, myhome.php, post.php, and moderator.php that allow remote attackers to execute arbitrary code by including code in an image tag or a link. The PT-2004-2864 entry confirm...
