CVE-2006-5063

CVE-2006-5063 is an XSS vulnerability in elog (web-based logbook), where editing log entries in HTML mode allows remote attackers to inject script/HTML. Affected: elog; root cause: HTML editing path lacks proper input sanitization. Impact: client-side script execution that can compromise user ses...

Multiple Mailman mail lists manager security vulnerabilities

Crossite scripting, DoS, log entris spoofing...

CVE-2006-3407: Undefined Security Weakness

Tor before 0.1.1.20 allows remote attackers to spoof log entries or possibly execute shell code via strings with non-printable characters...

CVE-2006-3407

Tor before 0.1.1.20 allows remote attackers to spoof log entries or possibly execute shell code via strings with non-printable characters...

CVE-2005-1960

The getemails function in C.J. Steele Tattle allows remote attackers to execute arbitrary commands via shell metacharacters in certain log entries, as demonstrated using shell metacharacters in an FTP username...

CVE-2004-1513: Undefined Security Weakness

04WebServer 1.42 does not adequately filter data that is written to log files, which could allow remote attackers to inject carriage return characters into the log file and spoof log entries...

CVE-2001-0902

Microsoft IIS 5.0 is affected. The vulnerability allows remote attackers to spoof web log entries by sending HTTP requests containing hex-encoded newline or form-feed characters, enabling log pollution/improper logging. CVE-2001-0902 details indicate impact to log integrity (partial) and potentia...

CVE-2003-0388

CVE-2003-0388 concerns the pam_wheel module in Linux-PAM where, if the trust option is enabled and use_uid is disabled, local users can spoof getlogin() results and potentially gain privileges. The issue affects Linux-PAM versions up to 0.77 (notably around the pam_wheel and pam_lastlog handling ...

CVE-2003-0388: Undefined Security Weakness

pamwheel in Linux-PAM 0.78, with the trust option enabled and the useuid option disabled, allows local users to spoof log entries and gain privileges by causing getlogin to return a spoofed user name...

CVE-2000-1007: Undefined Security Weakness

I-gear 3.5.7 and earlier does not properly process log entries in which a URL is longer than 255 characters, which allows an attacker to cause reporting errors...