Cross site scripting

Cross-site scripting XSS vulnerability in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openidtrustroot parameter and an inconsistent openidreturnto parameter, which is not properly handled in an error message...

CVE-2008-4529

Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP code via a URL in the ENVasicmspath parameter to 1 Association.php, 2 BigMath.php, 3 DiffieHellman.php, 4 DumbStore.php, 5 Extension.php, 6 FileStore.php, 7 HMAC.php, 8...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP code via a URL in the ENVasicmspath parameter to 1 Association.php, 2 BigMath.php, 3 DiffieHellman.php, 4 DumbStore.php, 5 Extension.php, 6 FileStore.php, 7 HMAC.php, 8...

CVE-2008-4529

Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP code via a URL in the ENVasicmspath parameter to 1 Association.php, 2 BigMath.php, 3 DiffieHellman.php, 4 DumbStore.php, 5 Extension.php, 6 FileStore.php, 7 HMAC.php, 8...

asiCMS alpha 0.208 - Multiple Remote File Inclusions

=========================================================================================== o asiCMS alpha 0.208 Multiple Remote File Inclusion Vulnerability Software : asiCMS version alpha 0.208 Vendor : http://asicms.sourceforge.net/ Download :...

XSS vulnerability in phpMyID

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Subject: XSS vulnerability in phpMyID Credits: Raphael Geissert [email protected] Release date: 2008-10-27 Affects: v0.9 23-Jul-2008 Resources: Homepage: http://siege.org/projects/phpMyID/ Demo: http://phpmyid.com Background: phpMyID is a single user...

CVE-2008-3218

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

CVE-2008-3221

Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...

CVE-2008-3221

Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...

CVE-2008-3218

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

CVE-2008-3221

CVE-2008-3221 is a Drupal CSRF vulnerability affecting Drupal 6.x prior to 6.3, allowing remote attackers to perform administrative actions via deletion of OpenID identities. The issue stems from cross-site request forgery in forms that enables unauthorized admin operations. Connected advisories ...

CVE-2008-3218

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

CVE-2008-3221

Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...

CVE-2008-3218

CVE-2008-3218 affects Drupal 6.x before 6.3, with XSS via free-tagging taxonomy terms on node previews and unspecified OpenID values. Remote attackers can inject arbitrary script/HTML. Connected advisories indicate remediation by upgrading to Drupal 6.4 (and related updates); no exploitation deta...

FreeBSD : drupal -- multiple vulnerabilities (ecedde1c-5128-11dd-a4e1-0030843d3802)

The Drupal Project reports : Free tagging taxonomy terms can be used to insert arbitrary script and HTML code cross site scripting or XSS on node preview pages. A successful exploit requires that the victim selects a term containing script code and chooses to preview the node. This issue affects...

SA-2008-045 - OpenID - Multiple vulnerabilities

The OpenID module for Drupal 5.x allows uses to create an account or log into a Drupal site using one or more OpenID identities. Find out more about OpenID at http://openid.net. Two vulnerabilities and weaknesses were discovered in the contributed OpenID module. Cross site scripting Some...

ikiwiki空口令绕过认证漏洞

BUGTRAQ ID: 29479 CVECAN ID: CVE-2008-0169 Ikiwiki是一个wiki编译器，可将wiki页面转换为可在网站发布的HTML页面。 Ikiwiki在处理访问认证时存在漏洞，如果在Ikiwiki中启用了openid和passwordauth插件的话（默认配置），用户就可以通过带有空口令的登录请求绕过认证限制登录，访问openid相关帐号。 ikiwiki ikiwiki 2.48 ikiwiki ikiwiki 1.34 ikiwiki ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2008-0169

Plugin/passwordauth.pm aka the passwordauth plugin in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence...