Unfixed XSS vulnerability at www.dockgames.com

Security researcher Mystick, has submitted on 11/10/2008 a cross-site-scripting XSS vulnerability affecting www.dockgames.com, which at the time of submission ranked 837993 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/11/2008. It is...

Google Chrome OnbeforeUload and OnUnload Null Check Vulnerability.

Advisory: Google Chrome OnbeforeUload and OnUnload Null Check Vulnerability. Version Affected: Chrome/0.2.149.30 Chrome/0.2.149.29 Chrome/0.2.149.27 Description: Google chrome is susceptible to stringent behavior while handling "onbeforeunload" and "onunload" event in body tags. The malicious...

Oracle BEA Weblogic 10 — Multiple Linked ХSS vulnerabilities

Application: Oracle BEA Weblogic 10 Versions Affected: Oracle BEA Weblogic 10 Vendor URL: Bugs: Multiple XSS Vulnerabilities in samples Exploits: YES Reported: 16.07.2008 Vendor response: 18.07.2008 Last response: 30.10.2008 Description: Review Service sample of WebLogic Server. Date of Public...

ImperialBB <= 2.3.5 Remote File Upload Exploit

No description provided by source. Title : ImperialBB = 2.3.5 Remote File Upload Vulnerability Date : 5th July 2008 Found by : PHPLizardo - http://phplizardo.2gb.fr Greetz : Gu1ll4um3r0m41n Howto : 1. Go to your User Control Panel 2. Upload any file you want 3. Tamper the request and change the...

ImperialBB 2.3.5 - Arbitrary File Upload

ImperialBB 2.3.5 - Arbitrary File Upload Title : ImperialBB :\r\n\n"; $code = trimfgetsSTDIN; $socket = @fsockopen$argv1, 80, $eno, $estr, 30...

ImperialBB 2.3.5 - Arbitrary File Upload

Title : ImperialBB :\r\n\n"; $code = trimfgetsSTDIN; $socket = @fsockopen$argv1, 80, $eno, $estr, 30; if!$socket die"Could not connect to ".$argv1."...

Unfixed XSS vulnerability at www.vertice-rock.tk

Security researcher xylitol, has submitted on 21/06/2008 a cross-site-scripting XSS vulnerability affecting www.vertice-rock.tk, which at the time of submission ranked 26502647 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/07/2008. It is...

Cross-site scripting vulnerability in the Unicode version of msearch

Overview The Unicode version of msearch, a full text search engine for websites, contains a cross-site scripting vulnerability. This problem is caused by a function added to the Unicode version of msearch. Impact A malicious script may be executed on the user's web browser. Solution None...

appservopen-xss.txt

========================================================== AppServ Open Project XSS =Example= Alert: - http://target/index.php?appservlang=" - http://target/index.php?appservlang=" Open Window - http://target/index.php?appservlang="window.open/phpinfo.php/ - http://target/index.php?appservlang="...

CVE-2003-1551

Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."...

Symantec Backup Exec Calendar ActiveX Control Multiple Vulnerabilities (SYM08-007)

The remote host contains the PVATLCalendar.PVCalendar.1 ActiveX control distributed with Symantec Backup Exec for Windows Servers. The installed version of that control reportedly contains two stack-based buffer overflows and allows for corrupting or saving malicious script code, and overwriting...

InfoSoft FusionCharts 3 - .swf Flash File Remote Code Execution

InfoSoft FusionCharts 3 - .swf Flash File Remote Code Execution source: https://www.securityfocus.com/bid/27109/info InfoSoft FusionCharts is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue t...

[Full-disclosure] 0day0day0day0day AURACMS XSS!! LATEST VERSION!!! 0day0day0day0day

0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day 0day0day0day0day 0day0day0day0day!!!!!!!!!!!!!!!!!!!!! BROUGHT 2 U BY UlTRa HAQRS 4 AL7 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 0day0day0day0dayTITle!!:::::::::::::AURA CMS 2.1...

Flatnuke 3 Remote Command Execution / Privilege Escalation

Exploit for unknown platform in category web applications ========================================================== Flatnuke 3 Remote Command Execution / Privilege Escalation ========================================================== --------------------------------------------------------------...

Unfixed XSS vulnerability at composto.boun.edu.tr

Security researcher CiCoSz, has submitted on 10/08/2007 a cross-site-scripting XSS vulnerability affecting composto.boun.edu.tr, which at the time of submission ranked 19923 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is...

Netkamp Emlak Scripti - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/25875/info Netkamp Emlak Scripti is prone to multiple input-validation vulnerabilities, including multiple HTML-injection issues and an SQL-injection issue, because the application fails to sanitize user-supplied input. A successful exploit may allow an...

ibmatom-xss.txt

XSS using Atom feed in www.ibm.com Abstract: A XSS using Atom feed was in www.ibm.com already fixed. This XSS technique appears only by IE6, not appears on IE7 and Firefox. Poc: http://www.ibm.com/fscripts/search/opensearch/search.fcgi/a.html?...

PHPMyQuote 0.20 - '/index.php' SQL Injection / Cross-Site Scripting

source: https://www.securityfocus.com/bid/25615/info phpMyQuote is prone to multiple input-validation vulnerabilities, including a cross-site scripting issue and an SQL-injection issue, because the application fails to sanitize user-supplied input. A successful exploit may allow an attacker to...

ppstream-overflow.txt

// author: dummy // written by [email protected] 2007 define CRTSECURENODEPRECATE include include const unsigned char shellcode174 = 0xE8, 0x00, 0x00, 0x00, 0x00, 0x6A, 0x03, 0xEB, 0x21, 0x7E, 0xD8, 0xE2, 0x73, 0x98, 0xFE, 0x8A, 0x0E, 0x8E, 0x4E, 0x0E, 0xEC, 0x55, 0x52, 0x4C, 0x4D, 0x4F, 0x4E, 0x00,...

Cisco CallManager 4.2 / CUCM 4.2 - Logon Page 'lang' SQL Injection

source: https://www.securityfocus.com/bid/25480/info Cisco Unified CallManager and Unified Communications Manager are prone to multiple input-validation vulnerabilities because the applications fail to properly sanitize user-supplied input. These issues include a cross-site scripting vulnerabilit...