opera -- multiple vulnerabilities

The Opera Team reports: Manipulating certain text-area contents can cause a buffer overflow, which may be exploited to execute arbitrary code. Certain HTML constructs can cause the resulting DOM to change unexpectedly, which triggers a crash. To inject code, additional techniques will have to be...

Apache mod_proxy_ftp Directory Component Wildcard Character Globbing XSS

The modproxyftp module in the version of Apache running on the remote host fails to properly sanitize user-supplied URL input before using it to generate dynamic HTML output. Using specially crafted requests for FTP URLs with globbing characters such as asterisk, tilde, opening square bracket, et...

Resin viewfile Servlet file Parameter XSS

The remote host is running Resin, an application server. The 'viewfile' Servlet included with the version of Resin installed on the remote host fails to sanitize user input to the 'file' parameter before including it in dynamic HTML output. An attacker may be able to leverage this issue to inject...

Xerox DocuShare dsweb Servlet Multiple XSS

The remote host is running DocuShare, a web-based document management application from Xerox. The version of DocuShare installed on the remote host fails to sanitize user input to the 'dsweb' servlet before including it in dynamic HTML output. An attacker may be able to leverage this issue to...

Barracuda Spam Firewall cgi-bin/ldap_test.cgi email Parameter XSS

According to its firmware version, the remote Barracuda Spam Firewall device fails to filter input to the 'email' parameter of the '/cgi-bin/ldaptest.cgi' script before using it to generate dynamic content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary...

Sun Java System Web Server Search Module XSS

The remote host is running Sun Java System Web Server, a Java application for user provisioning and identity auditing in enterprise environments. The version of Sun Java System Web Server installed on the remote host fails to sanitize user-supplied input to its Search module before using it to...

Cross site scripting

Cross-site scripting XSS vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML by using the window.open function to change the security context of a web page...

CVE-2008-1006

Cross-site scripting XSS vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML by using the window.open function to change the security context of a web page...

CVE-2008-1006

Cross-site scripting XSS vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML by using the window.open function to change the security context of a web page...

alkacon-xssdisclose.txt

Alkacon OpenCms logfileViewSettings.jsp XSS, file disclosure Product: Alkacon OpenCms http://www.opencms.org/ OpenCms contains a vulnerability in the Logfile Viewer Settings function. Input to Parameter filePath.0 in page opencms/system/workplace/admin/workplace/logfileview/logfileViewSettings.js...

GLSA-200803-09 : Opera: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200803-09 Opera: Multiple vulnerabilities Mozilla discovered that Opera does not handle input to file form fields properly, allowing scripts to manipulate the file path CVE-2008-1080. Max Leonov found out that image comments might...

ProjectPier index.php Multiple Parameter XSS

The remote host is running ProjectPier, an open source project management tool written in PHP. The version of ProjectPier installed on the remote host fails to sanitize user input to the 'refc' and 'refa' parameters of the 'index.php' script before using it to generate dynamic HTML output. An...

Sun Java System Identity Manager Multiple XSS

The remote host is running Sun Java System Identity Manager, a Java application for user provisioning and identity auditing in enterprise environments. The version of Identity Manager installed on the remote host fails to sanitize user-supplied input to various JSP scripts before using it to...

Mort Bay Jetty Dump Servlet (webapps/test/jsp/dump.jsp) XSS

The remote instance of Mort Bay Jetty includes a test servlet, 'webapps/test/jsp/dump.jsp', that fails to sanitize user-supplied input before using it to generate dynamic content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a...

PR07-15: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN 'my.logon.php3' server-side script

PR07-15: Cross-site Scripting XSS / HTML injection on F5 FirePass 4100 SSL VPN 'my.logon.php3' server-side script Date Found: 19th June 2007 Successfully tested on: version 5.5.2 F5 Networks has confirmed the following versions to be vulnerable: FirePass versions 5.4.1 - 5.5.2 FirePass versions 6...

ht://dig htsearch sort Parameter XSS

The htsearch CGI script is accessible through the remote web server. htsearch is a component of ht://Dig used to index and search documents such as web pages. The version of htsearch installed on the remote host fails to sanitize user-supplied input to the 'sort' parameter before using it to...

Cisco Unified MeetingPlace Login Screen Cross-Site Scripting Vulnerability

Cisco Unified MeetingPlace versions 5.3.235.0 and prior, 5.4, and 6.0 contain a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability is due to insufficient filtering of parameters passed to the Login form of Cisco Unified...

ManageEngine OpManager Login.do Multiple Parameter XSS

The remote host is running ManageEngine OpManager, a web-based network management application. The version of ManageEngine OpManager installed on the remote host fails to sanitize user input to the 'requestid' parameter of the 'jsp/Login.do' script before using it to generate dynamic content. An...

CVE-2007-5700

The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information...

Design/Logic Flaw

The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information...