CVE-2005-1792

The connected Seebug document confirms CVE-2005-1792 affects Microsoft Windows XP via the WMI service. The vulnerability allows remote attackers to trigger a denial-of-service by causing memory leaks and system unresponsiveness because security contexts are created faster than RPC cache entries c...

CVE-2005-0150

Firefox before 1.0 allows the user to store a 1 javascript: or 2 data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code...

CVE-2005-0150

Firefox before 1.0 allows the user to store a 1 javascript: or 2 data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code...

Skull-Splitter Guestbook 1.02.02.2 - Multiple HTML Injection Vulnerabilities

Skull-Splitter Guestbook 1.02.02.2 - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/13632/info Skull-Splitter Guestbook is prone to multiple HTML injection vulnerabilities. It is possible to inject HTML and script code into the title and content of posted...

Skull-Splitter Guestbook 1.0/2.0/2.2 - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/13632/info Skull-Splitter Guestbook is prone to multiple HTML injection vulnerabilities. It is possible to inject HTML and script code into the title and content of posted messages. The attacker-supplied HTML and script code would be able to access...

PHP-Nuke 6.x7.x Downloads Module - Lid Cross-Site Scripting

PHP-Nuke 6.x7.x Downloads Module - Lid Cross-Site Scripting source: https://www.securityfocus.com/bid/13011/info It is reported that the PHP-Nuke 'Downloads' module is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize...

paNews20b4.txt

PersianHacker.NET 200505-06 paNews v2.0b4 XSS Vulnerability Date: 2005 February Bug Number: 06 paNews is a news management script to use on your site. Users can use paCode, special code designed to allow the adding of images and font changes in the posts without allowing users to use HTML to post...

CVE-2005-0150

CVE-2005-0150 affects Mozilla Firefox versions prior to 1.0. The bug allows storing javascript: or data: Livefeed bookmarks that are later executed in the context of the current page, enabling remote attackers to potentially run arbitrary code. Public descriptions consistently state Firefox pre-1...

MySQL Eventum index.php email Parameter XSS

The MySQL Eventum install hosted on the remote web server is vulnerable to a cross-site scripting attack because it fails to sanitize user-supplied input to the 'email' parameter of the 'index.php' script before using it to generate dynamic HTML output. With a specially crafted URL, an attacker c...

IBM Lotus Domino 6.x - Cross-Site Scripting HTML Injection

IBM Lotus Domino 6.x - Cross-Site Scripting HTML Injection source: https://www.securityfocus.com/bid/11458/info It is reported that Lotus Domino is susceptible to a cross-site scripting and an HTML injection vulnerability. These issues are due to a failure of the application to properly sanitize...

Citrix NFuse Launch Scripts 'NFuse_Application' Parameter XSS

The remote version of Citrix NFuse contains a flaw that allows a remote cross-site scripting attack. An attacker can exploit this issue to execute arbitrary HTML or script code in a user's browser within the security context of the affected site. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Cross Site Scripting Vulnerability in Sympa

--------------------------------------------------------------------------- Cross Site Scripting Vulnerability in Sympa --------------------------------------------------------------------------- Author: Joxean Koret Date: 2004 Location: Basque Country...

VulnCheck KEV: CVE-2004-0549

The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine MSHTML, as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as...

APSIS Pound 1.5 - Remote Format String

APSIS Pound 1.5 - Remote Format String // source: https://www.securityfocus.com/bid/10267/info APSIS Pound has been found to be prone to a remote format string vulnerability. The problem presents itself when Pound handles certain requests containing embedded format string specifiers. Ultimately...

APSIS Pound 1.5 - Remote Format String

// source: https://www.securityfocus.com/bid/10267/info APSIS Pound has been found to be prone to a remote format string vulnerability. The problem presents itself when Pound handles certain requests containing embedded format string specifiers. Ultimately this vulnerability could allow for...

Mephistoles HTTPd 0.6 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/9470/info Mephistoles 'httpd' daemon fails to sanitize user-supplied input, making it vulnerable to cross-site scripting attacks. This vulnerability allows an attacker to construct a malicious link containing HTML or script code that may be rendered in a...

KnowledgeBuilder 2.02.13.0 - Remote File Inclusion

KnowledgeBuilder 2.02.13.0 - Remote File Inclusion source: https://www.securityfocus.com/bid/9292/info KnowledgeBuilder is prone to a remote file include vulnerability. An attacker could exploit this to cause hostile PHP scripts to be included and executed from a remote server. This would occur i...

CVE-2003-0726

RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via a SMIL presentation with a URL that references a scripting protocol, which is executed in the security context of the previously loaded URL, as demonstrated using a "javascript:" URL in the area tag...

Vulnerability in Exchange Server 5.5 Outlook Web Access Could Allow Cross-Site Scripting Attack (Microsoft Security Bulletin MS03-047)

From Microsoft Security Bulletin MS03-047: A cross-site scripting XSS vulnerability results due to the way that Outlook Web Access OWA performs HTML encoding in the Compose New Message form. An attacker could seek to exploit this vulnerability by having a user run script on the attacker's behalf...

CVE-2003-0726

RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via a SMIL presentation with a URL that references a scripting protocol, which is executed in the security context of the previously loaded URL, as demonstrated using a "javascript:" URL in the area tag...