Horde Passwd模块backend参数跨站脚本漏洞

BUGTRAQ ID: 35573 Horde Framework是个以PHP为基础的架构，用来创建网络应用程序；Passwd是其中用于更改口令的模块。 Horde Passwd模块的passwd/main.php文件没有正确的过滤用户所提交的backend参数，远程攻击者可以通过向该模块提交恶意请求执行跨站脚本攻击，导致在用户浏览器会话中执行任意HTML和脚本代码。 Horde Passwd 3.1 厂商补丁： Horde ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2009-2360

Cross-site scripting XSS vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter...

CVE-2009-2360

Cross-site scripting XSS vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter...

CVE-2009-2360

Cross-site scripting XSS vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter...

CVE-2009-2360

Cross-site scripting XSS vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter...

CVE-2009-2360

CVE-2009-2360 is an XSS vulnerability in Horde Passwd (passwd/main.php) where the backend parameter is not properly sanitized in Horde before version 3.1.1. The flaw could allow remote attackers to inject web script/HTML. Documents indicate this issue is part of a set of Horde vulnerabilities (GL...

CVE-2009-2360: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter...

Gravy Media Photo Host 1.0.8 Local File Disclosure Vulnerability

No description provided by source. ================================================================== =========Gravy Media Photo Host 1.0.8 Local File Inclusion======== ================================================================== Vendor:http://www.gravy-media.com/ Download:register to...

CVE-2009-1699: Improper Restriction of XML External Entity Reference

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a...

Horde 3.1 - Passwd Module Cross-Site Scripting

Horde 3.1 - Passwd Module Cross-Site Scripting source: https://www.securityfocus.com/bid/35573/info The Horde 'Passwd' module is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script...

Horde 3.1 - 'Passwd' Module Cross-Site Scripting

source: https://www.securityfocus.com/bid/35573/info The Horde 'Passwd' module is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in...

HP-UX Update for passwd(1) HPSBUX00191

Check for the Version of passwd1 OpenVAS Vulnerability Test HP-UX Update for passwd1 HPSBUX00191 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

HP-UX Update for passwd(1) HPSBUX00191

Check for the Version of passwd1 OpenVAS Vulnerability Test HP-UX Update for passwd1 HPSBUX00191 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Solaris 8 (sparc) : 111659-07

SunOS 5.8: passwd and pamunix.so.1 patch. Date this patch was last updated by Sun : Jul/09/02 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

NotFTP 1.3.1 - newlang Local File Inclusion

NotFTP 1.3.1 - newlang Local File Inclusion NotFTP 1.3.1 = Local file include http://sourceforge.net/projects/notftp/ Author: Kacper Email: [email protected] Home: http://devilteam.pl/ DC++ Hub address: bluber-hub.no-ip.biz:2008 Vuln: File config.php: This is where we decide what language to us...

Sql injection

SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd parameters...

Sql injection

SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd parameters...

CVE-2009-0738: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd parameters...

CVE-2009-0739: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd parameters...