Bandersnatch 0.4 - Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/25094/info Bandersnatch is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-supplied input. These issues include multiple SQL-injections vulnerabilities and an HTML-injecti...

MS IE 5/6 OBJECT Tag Same Origin Policy Violation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5196/info Microsoft Internet Explorer allows script code to violate the same origin policy through usage of the HTML OBJECT tag. Malicious script code may obtain a legitimate reference to an embedded object containing a w...

InfoSoft FusionCharts 3 SWF Flash File Remote Code Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27109/info InfoSoft FusionCharts is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute malicious script cod...

FarsiNews 2.1/2.5 show_archives.php template Parameter Traversal Arbitrary File Access

No description provided by source. source: http://www.securityfocus.com/bid/16580/info FarsiNews is prone to directory-traversal and local file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit the...

Dating Gold 3.0.5 secure.admin.php int_path Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/24910/info AzDG Dating Gold is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute an arbitrary...

phpWebSite 0.7.3/0.8.2/0.8.3/0.9.2 pagemaster Module PAGE_id Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/8393/info PHP Website is a web site content management system that allows for easy maintainance and administration of interactive community-driven websites. Cross-site vulnerabilities have been reported in the Calendar,...

Nessus 2.0.x LibNASL Arbitrary Code Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7664/info Nessus has reported that various flaws have been discovered in the 'libnasl' library used by the Nessus application. As a result, a malicious NASL script may be able to break outside of the established sandbox...

AN Guestbook 0.4 - 'send_email.php' Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/29254/info AN Guestbook ANG is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser o...

IcrediBB 1.1 Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4548/info IcrediBB is freely available web forum software. It is written in PHP and will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. IcrediBB does not adequately filter script code...

EasyDynamicPages 1.0 config_page.php Remote PHP File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9338/info EasyDynamicPages is prone to a remote file include vulnerability in a configuration script. This will permit a remote attack to include malicious PHP scripts from remote servers, which will then be executed by t...

Internet Explorer 4.0/5.0/5.5 preview/5.0.1 - DocumentComplete() Cross Frame Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1224/info The DocumentComplete function in IE does not properly validate origin domains. Therefore it is possible for a remote webserver to gain read access to local files on the machine of any website visitor or email...

Cloudflare: XSS - http://js.cloudflare.com

Hi. I want to report to you a Reflected XSScross site scripting vulnerability that I found in Cloudflare web-application and in a considerable percent can affect the safety of the users . Generally, an "attacker" can use XSS to send a malicious script to an unsuspecting user. The end user's brows...

OpenStack Horizon Orchestration Dashboard栈模版描述字段存储型跨站脚本漏洞

CVE ID:CVE-2014-0157 OpenStack Horizon用于为所有OpenStack服务提供一个模块化的基于页面的用户接口。 OpenStack Horizon Orchestration dashboard没有校验栈模版的描述符字段输入，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 OpenStack Horizon 2013.2 OpenStack Horizon 2013.2.3 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： https://review.openstack.org/86054...

ownCloud多个跨站脚本漏洞

ownCloud是一款开源的私有云服务器。 ownCloud存在多个跨站脚本漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 ownCloud 6.x ownCloud 6.0.2已经修复该漏洞，建议用户下载更新： http://owncloud.org...

WordPress VideoWhisper Live Streaming Integration多个跨站脚本漏洞

Bugtraq ID:65876 CVE ID:CVE-2014-1906 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志。 WordPress VideoWhisper Live Streaming Integration存在多个跨站脚本漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 WordPress VideoWhisper Live Streaming Integration 4.27.3 厂商补丁： WordPress ----- WordPre...

Drupal Project Issue File Review模块HTML注入漏洞

Bugtraq ID:65830 Drupal是一套开放源码的内容管理平台。 Drupal Project Issue File Review存在跨站脚本漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 Drupal Project Issue File Review 6.x-2.0 厂商补丁： Drupal ----- Drupal Project Issue File Review 6.x-2.17已经修复该漏洞，建议用户下载更新： http://drupal.org/project/projectissuefilerev...

IBM Sterling Connect:Enterprise跨站脚本漏洞

CVE ID:CVE-2013-6327 IBM Sterling Connect是一款点到点文件传输软件，可实现企业内和企业间的大容量、安全可靠的文件交付。 IBM Sterling Connect:Enterprise存在一个未明跨站脚本漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时可获取敏感信息或者劫持用户会话。 0 IBM Sterling Connect:Enterprise 1.3.0.2 IBM Sterling Connect:Enterprise 1.4.0.0. 厂商补丁： IBM ----- IBM Sterling Connect...

Feetan Inc WireShare v1.9.1 iOS - Persistent Vulnerability

Document Title: =============== Feetan Inc WireShare v1.9.1 iOS - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1157 Release Date: ============= 2013-12-05 Vulnerability Laboratory ID VL-ID: ====================================...

Feetan Inc WireShare v1.9.1 iOS - Persistent Vulnerability

Document Title: =============== Feetan Inc WireShare v1.9.1 iOS - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1157 Release Date: ============= 2013-12-05 Vulnerability Laboratory ID VL-ID: ====================================...

Google Gmail IOS Mobile Application - Persistent Cross-Site Scripting

Google Gmail IOS Mobile Application - Persistent Cross-Site Scripting Title: ====== Gmail IOS Application Attachment Cross Site Scripting Date: ===== 2013-11-11 Introduction: ============= Gmail is a free, advertising-supported email service provided by Google. Users may access Gmail as secure...