4082 matches found
DRUPAL-SA-2006-024 - Drupal core - Multiple cross site scripting vulnerabilities
Multiple XSS cross site scripting vulnerabilities have been discovered. A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS...
drupal -- multiple XSS vulnerabilities
The Drupal Team reports: A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS attack via a specially crafted RSS feed. This...
Debian DSA-944-1 : mantis - several vulnerabilities
Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-4238 Missing input sanitising allows remote attackers to inject arbitrary web script or HTML. -...
SharpReader < 0.9.7.1 RSS Feed XSS (deprecated)
Binary data 3748.prm...
FeedDemon < 2.0.0.25 Atom Feed Active Script Code Execution
According to the Windows registry, the version of FeedDemon, an RSS reader for Windows, installed on the remote host is affected by a flaw due to improper sanitization of RSS feeds of Active Script code. An attacker can exploit this issue to inject arbitrary script into the affected application,...
CVE-2006-4829: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in David Czarnecki Blojsom 2.31 allow remote attackers to inject arbitrary web script or HTML via the 1 blog-category-description, 2 blog-entry-title, 3 rss-enclosure-url, 4 technorati-tagsi, or 5 blog-category-name parameter in a blog post...
CVE-2006-4762
Multiple cross-site scripting XSS vulnerabilities in Ykoon RssReader allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test suite...
CVE-2006-4761
Multiple cross-site scripting XSS vulnerabilities in Luke Hutteman SharpReader allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test suite...
CVE-2006-4761
Multiple cross-site scripting XSS vulnerabilities in Luke Hutteman SharpReader allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test suite...
CVE-2006-4712
Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...
CVE-2006-4712
Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...
CVE-2006-4712
CVE-2006-4712 affects Sage 1.3.6 and describes multiple XSS vulnerabilities in which remote attackers can inject arbitrary script via a content:encoded element in an RSS feed, demonstrated by four content:encoded elements that use XMLHttpRequest to read local files (Cross Context Scripting). The ...
CVE-2006-4712
Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...
CVE-2006-4712: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...
MagpieRSS (a simple RSS integration tool) Full path vul
Hello MagpieRSS a simple RSS integration tool Full path vul magpierss/rssfetch.inc.php magpierss/rssparse.inc.php...
CVE-2006-4660
Multiple cross-site scripting XSS vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll allow remote attackers to process arbitrary web script or HTML in the Feeds interface context via the 1 title and 2 description elements within an item element in an...
CVE-2006-4660
Multiple cross-site scripting XSS vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll allow remote attackers to process arbitrary web script or HTML in the Feeds interface context via the 1 title and 2 description elements within an item element in an...
CVE-2006-4660
CVE-2006-4660 concerns multiple XSS vulnerabilities in the RSS Feed module of AOL ICQ Toolbar 1.3 for Internet Explorer. The weaknesses arise from the RSS feed item fields (title and description) being appended to HTML output without sanitization, enabling remote attackers to execute arbitrary sc...
CVE-2006-4660: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll allow remote attackers to process arbitrary web script or HTML in the Feeds interface context via the 1 title and 2 description elements within an item element in an...