Fizzle 0.5 - RSS Feed HTML Injection

source: https://www.securityfocus.com/bid/23144/info Fizzle is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of the...

Slackware 10.0 / 10.1 / 10.2 / current : kdebase kdm local file reading vulnerability (SSA:2006-178-01)

New kdebase packages are available for Slackware 10.0, 10.1, 10.2, and -current to fix a security issue with KDM the KDE login manager which could be exploited by a local attacker to read any file on the system. The official KDE security advisory may be found here:...

[Full-Disclosure] Adobe SVG Viewer Local and Remote File Reading (GM#003-MC)

GreyMagic Security Advisory GM003-MC ===================================== By GreyMagic Software, Israel. 07 Oct 2003. Available in HTML format at http://security.greymagic.com/adv/gm003-mc/. Topic: Adobe SVG Viewer Local and Remote File Reading. Discovery date: 07 Sep 2003. Affected applications...

MSIE->HijackClick: 1+1=2

HijackClick: 1+1=2. tested Browser Ver MS Internet Explorer: 6.0.2600.0000.xpclntqfe.021108-2107; Encryption: 128-bit; Patch:; Q810847; So, it's far from fully patched. OS Ver: "Windows XP Cn ver" demo POF VER http://www.safecenter.net/liudieyu/HijackClick/HijackClick-MyPage.HTM or...

GDM security update

Upgraded gdm packages are available for Slackware 9.0 and -current. These fix a security issue where a local user may use GDM to read any file on the system. Here are the details from the Slackware 9.0 ChangeLog: Sun Aug 24 14:36:29 PDT 2003 patches/packages/gdm-2.4.1.6-i386-1.tgz: Upgraded to...

Multiple bugs in Macromedia flash plugin

Buffer overflows, local file reading...

File reading vulnerable in PHP and MySQL (Local Exploit)

Attacker can use PHP and mySQL to read some local file following this way: Create a database mySQL and upload this file to your server PHP Code: viewfile.php programmed by Luke ====================================================== ? // config this data $dbhost = ""; $dbuser = ""; $dbpasswd = "";...

Microsoft Word and Excel documents allow local file reading by via embedded fields

Overview Microsoft Word and Excel contain special encoding tags for formatting and updating content. An attacker may be able to use these tags to exploit an information disclosure vulnerability. Description Microsoft Word and Microsoft Excel are applications that ship as part of the Microsoft...

IE allows universal Cross Domain Scripting (TL#003)

Thor Larholm, PivX, security advisory TL003 ------------------------------------- By Thor Larholm, Denmark 10 July 2002 HTML format: http://www.PivX.com/larholm/adv/TL003/ Topic: IE allows universal Cross Domain Scripting. Discovery date: 25 June 2002. Severity: High Affected applications:...

CVE-2002-0129

efax 0.9 and earlier, when installed setuid root, allows local users to read arbitrary files via the -d option, which prints the contents of the file in a warning message...

CVE-2001-1000

rlmadmin RADIUS management utility in Merit AAA Server 3.8M, 5.01, and possibly other versions, allows local users to read arbitrary files via a symlink attack on the rlmadmin.help file...

PHP Phorum quick fix

The major problem in Phorum, if all else is secured with the admin area off limits to anyone, seems to be the reading of local server files. In that last email on this in the correspondance part you can see the following... snip Hi jason, The fix that is provided in Phorum's site doesn't...

Netscape PublishingXPert 2.02.22.5 - Local File Reading

Netscape PublishingXPert 2.02.22.5 - Local File Reading // source: https://www.securityfocus.com/bid/2920/info Netscape PublishingXpert is an e-commerce application distributed by Netscape. PublishingXpert manages user information, sending them special ads and personalized content. PSCOErrPage.ht...