foswiki -- Script Insertion Vulnerability via unchecked user registration fields

Foswiki team reports: When a new user registers, the new user can add arbitrary HTML and script code into the user topic which is generated by the RegistrationAgent via standard registration fields such as "FirstName" or "OrganisationName". By design, Foswiki's normal editing features allow...

Unfixed Script Insertion vulnerability at www.profileex.com

Security researcher Sony, has submitted on 04/01/2012 a Script Insertion vulnerability affecting www.profileex.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/01/2012. It is currently unfixed. If...

Unfixed Script Insertion vulnerability at www.milw0rm.nl

Security researcher shellc0de, has submitted on 17/03/2012 a Script Insertion vulnerability affecting www.milw0rm.nl, which at the time of submission ranked 13100591 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/04/2012. It is currently...

Zend Server 5.6.0 multiple remote script insertion defect and repair-vulnerability warning-the black bar safety net

!-- Title: Zend Server 5.6.0 Multiple Remote Script Insertion Vulnerabilities Author: Zend Technologies Ltd. Product home page: http://www.zend.com Affected version: Zend Server 5.6.0 Zend Optimizer+ 4.1 Zend Code Tracing 1.0 Zend Data Cache 4.0 Zend Job Queue 4.0 Zend Debugger 5.3 Zend Java Brid...

Zend Server 5.6.0 - Multiple Remote Script Insertion Vulnerabilities

Zend Server 5.6.0 - Multiple Remote Script Insertion Vulnerabilities !-- Title: Zend Server 5.6.0 Multiple Remote Script Insertion Vulnerabilities Vendor: Zend Technologies Ltd. Product web page: http://www.zend.com Affected version: Zend Server 5.6.0 Zend Optimizer+ 4.1 Zend Code Tracing 1.0 Zen...

Zend Server 5.6.0 Script Insertion

Exploit for php platform in category web applications 0day.today 2018-01-03...

Zend Server 5.6.0 Multiple Remote Script Insertion Vulnerabilities

Summary Zend Server is a complete, enterprise-ready Web Application Server for running and managing PHP applications. Description Zend Server and its components suffers from a cross-site scripting vulnerability. The persistent stored XSS issues are triggered when input passed via several paramete...

PlumeCMS <= 1.2.4 CSRF Vulnerability

Exploit for php platform in category web applications +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : PlumeCMS CSRF Exploit to add and publish News input type="hidden"...

Unfixed Script Insertion vulnerability at www.pingplace.nl

Security researcher Killer-TR, has submitted on 18/02/2012 a Script Insertion vulnerability affecting www.pingplace.nl, which at the time of submission ranked 2570652 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/08/2012. It is currently...

Unfixed Script Insertion vulnerability at jicama.cs.washington.edu

Security researcher Sony, has submitted on 16/02/2012 a Script Insertion vulnerability affecting jicama.cs.washington.edu, which at the time of submission ranked 3079 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/02/2012. It is currently...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting XSS sequences via the 1 address or 2 threadid parameters to operator/ban.php; or 3...

Debian Security Advisory DSA 2365-1 (dtc)

The remote host is missing an update to dtc announced via advisory DSA 2365-1. OpenVAS Vulnerability Test $Id: deb23651.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2365-1 dtc Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Debian: Security Advisory (DSA-2365-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unfixed Script Insertion vulnerability at amhost.bplaced.net

Security researcher shellc0de, has submitted on 23/01/2012 a Script Insertion vulnerability affecting amhost.bplaced.net, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 25/01/2012. It is currently...

Unfixed Script Insertion vulnerability at pastehtml.com

Security researcher RemoteExecution, has submitted on 23/01/2012 a Script Insertion vulnerability affecting pastehtml.com, which at the time of submission ranked 34012 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/01/2012. It is currently...

Debian DSA-2365-1 : dtc - several vulnerabilities

Ansgar Burchardt, Mike O'Connor and Philipp Kern discovered multiple vulnerabilities in DTC, a web control panel for admin and accounting hosting services : - CVE-2011-3195 A possible shell insertion has been found in the mailing list handling. - CVE-2011-3196 Unix rights for the apache2.conf wer...

DSA-2365-1 dtc - several

Bulletin has no description...

Translate helper method which may allow an attacker to insert arbitrary code into a page

The helper method for i18n translations has a convention whereby translations strings with a name ending in 'html' are considered HTML safe. There is also a mechanism for interpolation. It has been discovered that these 'html' strings allow arbitrary values to be contained in the interpolated...

Microsoft Publisher 2007 Pubconv.dll内存破坏漏洞

CVE ID: CVE-2011-1508 Microsoft Publisher是微软公司发行的桌面出版应用软件。 Publisher 2007中存在输入验证错误，可被远程攻击者利用通过诱使用户在文档中插入特制的.pub文件执行任意代码。 通过修改.pub文件，可使pubconv.dll库复制很多文件内容到栈中，从而覆盖稍后执行的函数指针。 Microsoft Publisher 2007 12.0.6546.5000 厂商补丁： Microsoft --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Bugzilla: Multiple vulnerabilities

Background Bugzilla is the bug-tracking system from the Mozilla project. Description Multiple vulnerabilities have been discovered in Bugzilla. Please review the CVE identifiers referenced below for details. Impact A remote attacker could conduct cross-site scripting attacks, conduct script...