httpd cross-site scripting flaw in mod_imap

Cross-site scripting XSS vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps...

CVE-2006-4798

SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...

CVE-2006-4798

SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...

CVE-2006-4798

SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...

CVE-2006-4798: Undefined Security Weakness

SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...

Sending multipart/form-data requests from Flash (with arbitrary headers)

Hello lists, In my original "Forging HTTP request headers with Flash" paper http://www.securityfocus.com/archive/1/441014, I mentioned forcing multipart/form-data input format to ensure that Flash's LoadVars isn't used to forge the request. However, there's a work-around for the attacker - using...

CVE-2006-4035

SQL injection vulnerability in counterchaos.php in CounterChaos 0.48c and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header...

CVE-2006-4035: Undefined Security Weakness

SQL injection vulnerability in counterchaos.php in CounterChaos 0.48c and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header...

[Full-disclosure] CounterChaos <= 0.48c SQL Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: CounterChaos = 0.48c SQL Injection Vulnerability Release Date: 2006/08/04 Last Modified: 2006/08/03 Author: Tamriel tamriel at gmx dot net Application: CounterChaos = 0.48c Risk: Moderate Vendor Status: not contacted Vendor Site:...

CVE-2006-3328

newticket.cgi in Hostflow 2.2.1-15 allows remote attackers to steal and replay authentication credentials via an IMG tag in the desc parameter "Ticket Description" field that points to a URL that captures referer URLs, possibly due to a cross-site scripting XSS vulnerability or a leak of...

CVE-2006-3328

CVE-2006-3328 affects Hostflow 2.2.1-15. The issue is triggered by an IMG tag in the desc parameter (Ticket Description) that can capture referer URLs, enabling retrieval or replay of authentication credentials via potential XSS or credential leakage in referer headers. NVD lists a base score of ...

CVE-2006-3328: Undefined Security Weakness

newticket.cgi in Hostflow 2.2.1-15 allows remote attackers to steal and replay authentication credentials via an IMG tag in the desc parameter "Ticket Description" field that points to a URL that captures referer URLs, possibly due to a cross-site scripting XSS vulnerability or a leak of...

CVE-2006-3064: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the addhit function in include/function.inc.php in Coppermine Photo Gallery CPG 1.4.8, when "Keep detailed hit statistics" is enabled, allows remote attackers to execute arbitrary SQL commands via the 1 referer and 2 user-agent HTTP headers...

CVE-2006-2795

Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2006-2795: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...

Cross site scripting

Cross-site scripting XSS vulnerability in Neocrome Land Down Under LDU in Neocrome Seditio 102 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer field...

CVE-2006-2634

Cross-site scripting XSS vulnerability in Neocrome Land Down Under LDU in Neocrome Seditio 102 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer field...

CVE-2006-2634

Cross-site scripting XSS vulnerability in Neocrome Land Down Under LDU in Neocrome Seditio 102 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer field...

CVE-2006-2634: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Neocrome Land Down Under LDU in Neocrome Seditio 102 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer field...