iPlanet Web Server Search模块跨站脚本漏洞

iPlanet Web Server是一款WEB应用服务程序。 iPlanet Web Server不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 问题是搜索对用户提交的'NS-max-records'参数缺少过滤，提交恶意脚本代码作为参数数据，可导致获得敏感信息。 iPlanet Web Server 4.1 SP9 iPlanet Web Server 4.1 SP8 iPlanet Web Server 4.1 SP7 iPlanet Web Server 4.1 SP6 iPlanet Web Server 4.1 SP5 iPlanet Web...

PHP-Nuke <= 7.9 Search module "author" SQL Injection vulnerability

/ -------------------------------------------------------- Neo Security Team NST - Advisory 28 - 2006-10-25 -------------------------------------------------------- Program: PHP-Nuke Homepage: http://www.php.net Vulnerable Versions: PHP-Nuke = 7.9 Risk: Medium Impact: Medium Risk -==PHP-Nuke = 7....

hlstatsXSS.txt

Cross-site Scripting Vulnerability in HLStats 1.34 hlstats.php?mode=search&game=cstrike&st=player&q=%22%3CSCRIPT%3Ealert%28%22XSS%22%29%3B%3C%2FSCRIPT%3E%22 Search module fails to sanitize quotes. kefka [email protected] Thanks to RSnake...

CVE-2006-4107

CVE-2006-4107 describes an SQL injection vulnerability in Drupal’s Job Search module (job.module) for version 4.6 prior to revision 1.3.2.1. The vulnerability allows remote attackers to craft a job or resume search that could cause arbitrary SQL execution. The core issue is an injectable input ha...

CVE-2006-4017

Cross-site scripting XSS vulnerability in the search module in Inter Network Marketing INM CMS G3 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter...

CVE-2006-4017

Cross-site scripting XSS vulnerability in the search module in Inter Network Marketing INM CMS G3 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter...

DRUPAL-SA-2006-012: Jobsearch module

It is possible for a malicious user to inject SQL while searching for jobs or resumes using the Job Search module. Versions affected Please check the CVS $Id$ field in the file job.module to determine whether the version you are running is vulnerable. All 4.6 versions older than the following are...

Ashop Search Module SQL injection

http://SITE/default.asp?mod=search&type=simple&q=27+union+select+12Cadminpassword2C32C4+from+adminusers+27+&cmdSearch=Search credits: EntriKa & TheBeKiR & erne...

PHP-Nuke <= 7.9 Search XSS Vulnerability

PHP-Nuke = 7.9 Search module XSS Vulnerability It could work on later versions if PHP-Nuke does not patch it. 1: Enter: http://host/modules.php?name=Search 2: Search for: "body onload="alertdocument.cookie // You'll get a javascript alert with your cookie in it. Credits: O.G...

CVE-2006-2684

Cross-site scripting XSS vulnerability in the search module in CMS Mundo 1.0 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter...

CVE-2006-2684

Cross-site scripting XSS vulnerability in the search module in CMS Mundo 1.0 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter...

CVE-2006-2684

CVE-2006-2684 : An XSS vulnerability in the search module of CMS Mundo 1.0 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter. The root cause is not fully described beyond “XSS in search.” Impact details are limited in the provided documents; CVSS metric...

CVE-2006-2525

CVE-2006-2525 affects UseBB 1.0 RC1 and earlier. The vulnerability is a SQL injection in the member list search module that allows remote attackers to execute arbitrary SQL commands. The NVD metrics indicate a medium base score (6.4, CVSS v2) with network access, low attack complexity, and no use...

X-Cart SQL inj. vuln.

X-Cart SQL inj. vuln. Vuln. discovered by : r0t Date: 20 april 2006 vendorlink:http://www.x-cart.com/ affected versions: X-Cart Gold v4.0.18 X-Cart Pro v4.0.18 X-Cart 4.1.0 beta 1 and prior versions also can be affected . orginal advisory:...

ShopXS v4.0 XSS vuln.

ShopXS v4.0 XSS vuln. Vuln. discovered by : r0t Date: 10 april 2006 vendor:MK Internet-Service GmbH vendorlink:http://www.shopxs.de/ affected versions:ShopXS-Version 4.00 and previous orginal advisory:http://pridels.blogspot.com/2006/04/shopxs-v40-xss-vuln10.html Vuln. Description: Input passed t...

Sql injection

Multiple SQL injection vulnerabilities in Keystone Digital Library Suite DLS 1.5.4 and earlier allow remote attackers to execute arbitrary SQL commands via the subjecttypeid parameter in 1 the index page and 2 the search module...

CVE-2006-1416

Cross-site scripting XSS vulnerability in afmsearch.aspx in Absolute FAQ Manager .NET 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search module parameters, possibly the question parameter...

CVE-2006-1416

CVE-2006-1416 describes a cross-site scripting (XSS) vulnerability in the afmsearch.aspx page of Absolute FAQ Manager for .NET 4.0 and earlier. The issue arises from unsanitized input in the search module parameters (possibly the question parameter), enabling a remote attacker to inject arbitrary...

CVE-2006-1416

Cross-site scripting XSS vulnerability in afmsearch.aspx in Absolute FAQ Manager .NET 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search module parameters, possibly the question parameter...

CVE-2006-1411

Cross-site scripting XSS vulnerability in Absolute Image Gallery XE 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via 1 the shownew parameter in gallery.asp and 2 unspecified search module parameters...