1435 matches found
PHP-Blogger Multiple Cross Site Scripting Vulnerabilities
PHP-Blogger Multiple Cross Site Scripting Vulnerabilities OS2A ID: OS2A1006 Status: 14/06/2006 Issue Discovered 23/06/2006 Reported to the vendor No response on repeated notification 07/07/2006 Advisory Released Class: Cross Site Scripting Severity: Medium Overview: --------- PHP-Blogger is a fre...
FreeBSD : horde -- multiple parameter XSS vulnerabilities (09429f7c-fd6e-11da-b1cd-0050bf27ba24)
FrSIRT advisory ADV-2006-2356 reports : Multiple vulnerabilities have been identified in Horde Application Framework, which may be exploited by attackers to execute arbitrary scripting code. These flaws are due to input validation errors in the 'test.php' and 'templates/problem/problem.inc' scrip...
horde -- multiple parameter cross site scripting vulnerabilities
FrSIRT advisory ADV-2006-2356 reports: Multiple vulnerabilities have been identified in Horde Application Framework, which may be exploited by attackers to execute arbitrary scripting code. These flaws are due to input validation errors in the "test.php" and "templates/problem/problem.inc" script...
Code injection
Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code...
CVE-2006-1190
Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code...
CVE-2006-1190
CVE-2006-1190 concerns Microsoft Internet Explorer 5.01–6, where IOleClientSite information may be returned incorrectly when dynamically creating an embedded object. This could cause the object to run in the wrong security context/zone, enabling remote code execution or information disclosure. Th...
mysql -- database suid privilege escalation
Dmitri Lenev reports a privilege escalation in MySQL. MySQL evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote and local authenticated users to gain privileges through a routine that has been made available...
ArGoSoft Mail Server Pro Webmail viewheaders Multiple Field XSS
The remote host is running ArGoSoft Mail Server Pro, a messaging system for Windows. According to its banner, the webmail server bundled with the version of ArGoSoft Mail Server Pro installed on the remote host fails to properly filter message headers before displaying them as part of a message t...
Unchecked Buffer in XP Shell Could Enable System Compromise (329390)
It is possible for a malicious user to mount a buffer overrun attack using windows XP shell. A successful attack could have the effect of either causing the Windows Shell to fail, or causing an attacker's code to run on the user's computer in the security context of the user. Maximum Severity...
CuteNews index.php XSS
The remote web server contains a PHP script that is prone to cross-site scripting attacks. Description : The version of CuteNews installed on the remote host is vulnerable to a cross-site-scripting XSS attack. An attacker, exploiting this flaw, would need to be able to coerce a user to browse to ...
Mantis multiple unspecified XSS
The remote web server contains a PHP application that is prone to cross-site scripting attacks. Description : According to its banner, the remote version of Mantis contains a flaw in the handling of some types of input. Because of this, an attacker may be able to cause arbitrary HTML and script...
CuteNews index.php XSS
The version of CuteNews installed on the remote host is vulnerable to a cross-site-scripting XSS attack. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Goollery < 0.04b Multiple XSS Vulnerabilities - Active Check
Goollery is prone to multiple cross-site-scripting XSS vulnerabilities eg. through the SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
XSS & Path Disclosure in Chipmunk's products
Products: Chipmunk Forum , Topsites , Directory , Guestbook Versions: Tested: Last released of products Vendor: http://chipmunk-scripts.com Bug: XSS , Path Disclosure Exploitation: Remote --------------------------- Introduction: Chipmunk Forum is a small yet flexible and fully featured forum...
Frox 0.7.18 - Arbitrary Configuration File Access
source: https://www.securityfocus.com/bid/14711/info Frox is prone to a vulnerability that permits read access to arbitrary files. Successful exploitation of this vulnerability will grant the attacker read access to arbitrary files on the system in the security context of the Frox process...
phpLDAPadmin 0.9.60.9.7 - welcome.php Arbitrary File Inclusion
phpLDAPadmin 0.9.60.9.7 - welcome.php Arbitrary File Inclusion source: https://www.securityfocus.com/bid/14695/info phpldapadmin is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. phpldapadmin is...
Important: Red Hat Security Advisory: php security update
Updated PHP packages that fix a security issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A bug was discovered in the PEAR XML-RP...
OS2A-1001.txt
OS2A ePing Arbitrary File Creation/Command Execution Vulnerability OS2A ID: OS2A1001 Status Published: 08/04/2005 Updated : 08/05/2005 Patch Released Class: File Creation/Command Execution Severity: CRITICAL Overview: ePing is a ping utility plugin for e107, a PHP-based content management system...
CVE-2001-1514
CVE-2001-1514 affects ColdFusion 4.5 and 5 on Windows when the advanced security sandbox type is set to operating system. The issue is that security context is not properly passed to child processes created with or to those that call CreateProcess and are run via or end with the CFX extension, ...
Apple Web Kit-based browsers may allow remote access to local filesystem contents
Overview Web browsers based on AppleWebKit may allow remote web sites to reference content on the local filesystem. This may allow an attacker to execute script within the security context of the local machine. Description Web browsers that allow remote web sites to reference content that resides...