CVE-2005-1157

Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to replace existing search plugins with malicious ones using sidebar.addSearchEngine and the same filename as the target engine, which may not be displayed in the GUI, which could then be used to execute...

GLSA-200504-08 : phpMyAdmin: XSS vulnerability

The remote host is affected by the vulnerability described in GLSA-200504-08 phpMyAdmin: XSS vulnerability Oriol Torrent Santiago has discovered that phpMyAdmin fails to validate input to the 'convcharset' variable, rendering it vulnerable to cross-site scripting attacks. Impact : By sending a...

phpMyAdmin: Cross-site scripting vulnerability

Background phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL databases from a web-browser. Description Oriol Torrent Santiago has discovered that phpMyAdmin fails to validate input to the "convcharset" variable, rendering it vulnerable to cross-site scripting...

SonicWALL SOHO Web Interface XSS

The remote host is a SonicWALL SOHO appliance. This version is affected by multiple issues, specifically a cross- site scripting vulnerability due to a lack of sanitization of user-supplied data. Successful exploitation of this issue may allow an attacker to execute malicious script code on a...

Yet Another Forum.net XSS vulnerabilities

OVERVIEW ========= "Yet Another Forum.net http://www.yetanotherforum.net/ is a opensource discussion forum or bulletin board system for web sites running ASP.NET. It is ASP.NET based with a MS SQL backend database. The full C source code is available licensed as GPL. " Several Cross Site Scriptin...

Important: Red Hat Security Advisory: php security update

Updated php packages that fix various security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server...

phpBB 2.0.10 - 'ssh.D.Worm' Bot Install Altavista

!/usr/bin/perl ------------------------------------------------------------------------ Severino Honorato - /server irc.priv8crew.info Priv8crew - ssh.D.Worm use IO::Socket; use LWP::Simple; my $processo = "/usr/local/apache/bin/httpd -DSSL"; $SIG"INT" = "IGNORE"; $SIG"HUP" = "IGNORE"; $SIG"TERM"...

[SA13657] e107 Image Manager File Upload Vulnerability

TITLE: e107 Image Manager File Upload Vulnerability SECUNIA ADVISORY ID: SA13657 VERIFY ADVISORY: http://secunia.com/advisories/13657/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: e107 0.x http://secunia.com/product/1927/ DESCRIPTION: sysbug has reported a...

Microsoft Windows Media Player 9.0 - ActiveX Control Media File Attribute Corruption

source: https://www.securityfocus.com/bid/12031/info The Windows Media Player ActiveX control is prone to a security weakness. The issue is that the control may be abused by a Web page to change attributes of media files such as MP3. An attacker can influence attributes such as the artist, song...

STG Security Advisory 2004-11-22.11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 STG Security Advisory: SSA-20041122-11 JSPWiki XSS vulnerability Revision 1.0 Date Published: 2004-11-22 KST Last Update: 2004-11-22 Disclosed by SSR Team [email protected] Summary ======== JSPWiki is one of famous wiki web applications. It has...

Jan Erdmann Jebuch 1.0 - HTML Injection

Jan Erdmann Jebuch 1.0 - HTML Injection source: https://www.securityfocus.com/bid/11463/info It is reported that Jebuch is susceptible to an HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input. This may allow an attacker to inje...

CVE-2003-1326

Microsoft Internet Explorer 5.5 and 6.0 are affected by CVE-2003-1326, which enables remote attackers to bypass cross-domain security and execute script or arbitrary code via dialog boxes. The issue centers on improper handling of dialog frames and the dialogArguments mechanism, enabling cross-do...

Newtelligence DasBlog 1.x - Request Log HTML Injection

Newtelligence DasBlog 1.x - Request Log HTML Injection source: https://www.securityfocus.com/bid/11086/info DasBlog is reportedly susceptible to an HTML injection vulnerability in its request log. This vulnerability is due to a failure of the application to properly sanitize user-supplied input...

GNU Info 4.7 - Follow XRef Buffer Overrun

GNU Info 4.7 - Follow XRef Buffer Overrun source: https://www.securityfocus.com/bid/10882/info GNU Info is reported prone to a buffer overrun vulnerability. The vulnerability is reported to present itself due to a lack of boundary checks performed on argument data for the f follow xref Info...

Gallery 1.4.4 - Remote Server-Side Script Execution

Gallery 1.4.4 - Remote Server-Side Script Execution source: https://www.securityfocus.com/bid/10968/info A vulnerability is reported to exist in Gallery that may allow a remote attacker to execute malicious scripts on a vulnerable system. This issue is a design error that occurs due to the...

Microsoft Internet Explorer - Remote Wscript.Shell

----------------------------------------------------- default.htm ------------------------------------------------------- function InjectedDuringRedirection showModalDialog'md.htm',window,"dialogTop:-1000;dialogLeft:-1000;dialogHeight:1;dialogWidth:1;". location="vbscript:""";...

Microsoft Internet Explorer - Remote Application.Shell

function InjectedDuringRedirection showModalDialog'md.htm',window,"dialogTop:-10000;dialogLeft:-10000;dialogHeight:1; dialogWidth:1;".location="vbscript:"""; setTimeout"myiframe.execScriptInjectedDuringRedirection.toString",100; setTimeout"myiframe.execScript'InjectedDuringRedirection' ",101;...

PHP-Nuke 6.x7.x - Modpath File Inclusion

PHP-Nuke 6.x7.x - Modpath File Inclusion source: https://www.securityfocus.com/bid/10365/info PHP-Nuke is prone to a potential file include vulnerability. This issue could allow a remote attacker to include malicious files containing aribtrary code to be executed on a vulnerable system. This issu...

Microsoft Internet Explorer 5.0.1 - http-equiv Meta Tag Denial of Service

Microsoft Internet Explorer 5.0.1 - http-equiv Meta Tag Denial of Service source: https://www.securityfocus.com/bid/10351/info It has been reported that Internet Explorer is prone to a denial of service vulnerability when processing a malicious script containing the 'window.createPopup' method to...

Microsoft Internet Explorer 5.0.1 - http-equiv Meta Tag Denial of Service

source: https://www.securityfocus.com/bid/10351/info It has been reported that Internet Explorer is prone to a denial of service vulnerability when processing a malicious script containing the 'window.createPopup' method to invoke the 'http-equiv' meta tag. This issue could be exploited by a remo...