Vulnerability in Search Engine Builder

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в Search Engine Builder. XSS: Уязвимость на странице search.html в параметре searWords. http://site/search/search.html?searWords=3Cscript3Ealertdocument.cookie3C/script3E Дополнительная информация о данной уязвимост...

ALeadSoft Search Engine Builder - Search.HTML Cross-Site Scripting

source: https://www.securityfocus.com/bid/25391/info ALeadSoft Search Engine Builder is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

ALeadSoft Search Engine Builder - Search.HTML Cross-Site Scripting

ALeadSoft Search Engine Builder - Search.HTML Cross-Site Scripting source: https://www.securityfocus.com/bid/25391/info ALeadSoft Search Engine Builder is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage...

googlecustom-xss.txt

Google custom search engine contributors invite XSS Vendor url: http://www.google.com Product Url: http://www.google.com/coop/cse/ Advisore url:http://lostmon.blogspot.com/2007/08/ google-custom-search-engine.html Vendor notify :yes vendor confirmed: yes Fixed: YES Description: A Custom Search...

Baidu Soba Remote Code Execute Vulnerability(FGA-2007-10)

hi full-disclosure, Baidu Soba Remote Code Execute Vulnerability by cocoruder of Fortinet Security Research Team http://ruder.cdut.net Summary: Baidu Soba is a popular browser toolbar which developed by Baidu, a Chinese web search engine company, like Google, more informations can be found at:...

People Directory search can be misused to retrieve email addresses of all users

Even when email addresses should be hidden because of global settings, it is possible to retrieve email addresses of all the users in the system by misusing search in people directory. It seems that the email address is one of the attributes that are being indexed by the search engine. So if one...

Vulnerability in AltaVista local search engine

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в поисковике AltaVista local search engine. Уязвимость в параметре text в главном скрипте. XSS: http://site/?text=3Cscript3Ealertdocument.cookie3C/script3E О данной уязвимости я писал в рамках моего проекта Month of...

MOSEB-07 Bonus: Vulnerabilities in Yandex.Server

New bonus vulnerabilities in Yandex. In this case vulnerabilities not directly at Yandex’s site, like at MOSEB-07: Vulnerability at blogs.yandex.ru, but in local search engine made by Yandex. The holes are in Yandex.Server Яndex.Server, local search engine from Yandex, which used by a lot of site...

Vulnerabilities in Yandex.Server

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в локальном поисковике Яndex.Server. Уязвимости в параметрах query и within в главном скрипте. XSS: http://site/search/?query=223E3Cscript3Ealertdocument.cookie3C/script3E...

MOSEB-15 Bonus: Vulnerability in Google Custom Search Engine

MOSEB-15 Bonus: Vulnerability in Google Custom Search Engine 22:57 15.06.2007 New bonus vulnerability in Google. In this case vulnerability not directly at Google’s site, like at MOSEB-15: Vulnerabilities at images.google.com, but in his search engine called Google Custom Search Engine also known...

Vulnerability in Google Custom Search Engine

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в локальном поисковике Google Custom Search Engine. Уязвимость в параметре q в главном скрипте. XSS: http://site/search.php?q=3C2Ftitle3E3Cscript3Ealertdocument.cookie3C2Fscript3E О данной уязвимости я писал в рамка...

MOSEB-12 Bonus: Vulnerability in AltaVista

MOSEB-12 Bonus: Vulnerability in AltaVista 22:40 12.06.2007 New bonus vulnerability in AltaVista. In this case vulnerability not directly at AltaVista’s site, like at MOSEB-12: Vulnerabilities at www.altavista.com, but in local search engine made by AltaVista. The hole are in AltaVista local sear...

CVE-2007-3484

Cross-site scripting XSS vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this issue is disputed by the Google Security Team, who states that "Google does not provide the 'search.php' script...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this issue is disputed by the Google Security Team, who states that "Google does not provide the 'search.php' script...

Cross site scripting

Cross-site scripting XSS vulnerability in AltaVista search engine allows remote attackers to inject arbitrary web script or HTML via the text parameter to the default URI...

CVE-2007-3484

CVE-2007-3484 describes an XSS vulnerability in Google Custom Search Engine, where the q parameter in the search functionality is susceptible to script injection. The affected component is the search flow of Google Custom Search Engine (claims reference to a non-existent search.php script; Google...

CVE-2006-7209

Multiple cross-site scripting XSS vulnerabilities in phpTrafficA before 1.2beta2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to keywords results in the 1 main, 2 daily, 3 weekly, 4 monthly, 5 new trends, 6 individual page, and 7 search engine...

Design/Logic Flaw

A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/createengine.php followed by a request to...

CVE-2007-2988

The CVE-2007-2988 entry describes a vulnerability in the Inout Meta Search Engine: an admin script redirects the browser but does not exit when admin credentials are missing, enabling remote attackers to inject arbitrary PHP code via a sequence of requests to admin/create_engine.php and then admi...

CVE-2007-2988

A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/createengine.php followed by a request to...