7774 matches found
XSS in Firepass 4100 SSL VPN v.5.4.2 (and probably others)
Vulnerability class : Cross-Site Scripting Discovery date : 2nd of February 2006 Remote : Yes Local : No Credit : ILION Research Labs, Geneva Switzerland Vulnerable : F5 Firepass 4100 SSL VPN v. 5.4.2 A XSS Cross-Site-Scripting vulnerability has been uncovered in my.support.php3 called through a...
pubcookie-login-server -- cross site scripting vulnerability
Nathan Dors of the Pubcookie Project reports: Multiple non-persistent XSS vulnerabilities were found in the Pubcookie login server's compiled binary "index.cgi" CGI program. The CGI program mishandles untrusted data when printing responses to the browser. This makes the program vulnerable to...
Speartek XSS vuln.
Speartek XSS vuln. Vuln. discovered by : r0t Date: 21 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/speartek-xss-vuln.html vednor:http://www.speartek.com affected version:6.0 and prior Product Description: SpearTek's advanced solutions help you optimize the Internet channel to fu...
damoon(r) XSS vuln
damoonr XSS vuln Vuln. discovered by : r0t Date: 18 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/damoon-xss-vuln.html vendor:http://www.mindroute.us/?id=2452 affected version: latest Vuln. Description: damoonr contains a flaw that allows a remote cross site scripting attack. Thi...
mantis -- "view_filters_page.php" cross-site scripting vulnerability
r0t reports: Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because input passed to "targetfield" parameter in "viewfilterspage.php" isn't properly sanitised before being returned to the user. This could allow a user to create a specially crafted URL tha...
Go to the Black anti-phishing-exploit warning-the black bar safety net
With phishing attacksartin the country to be disclosed later, the networkas if into the vastness of the ocean, a wide variety of phishing attacks everywhere. A newtechnologyis public, I how could not go to attention? So they go online and in magazines to find some information abouttechnologyof...
mantis -- "view_filters_page.php" cross site scripting vulnerability
r0t reports: Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because input passed to "targetfield" parameter in "viewfilterspage.php" is not properly sanitised before being returned to the user. This could allow a user to create a specially crafted URL th...
WebCalendar 1.0.1 - 'Layers_Toggle.php' HTTP Response Splitting
source: https://www.securityfocus.com/bid/15673/info WebCalendar is prone to an HTTP response-splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker may exploit this vulnerability to influence or misrepresent how web...
PHP Handicapper - Process_signup.php HTTP Response Splitting
PHP Handicapper - Processsignup.php HTTP Response Splitting source: https://www.securityfocus.com/bid/15301/info PHP Handicapper is vulnerable to an HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker...
rmtSvc Trojan trial notes-vulnerability warning-the black bar safety net
Warning: please do not use this article weight relates to any method for authentication. line violations Next, I will list some of the so-called social engineering users are often use means: First of all, proficient social engineering users are adept at information gathering, many on the surface ...
CVE-2005-2072
The runtime linker ld.so in Solaris 8, 9, and 10 trusts the LDAUDIT environment variable in setuid or setgid programs, which allows local users to gain privileges by 1 modifying LDAUDIT to reference malicious code and possibly 2 using a long value for LDAUDIT...
ASPNuke 0.80 - 'Language_Select.asp' HTTP Response Splitting
source: https://www.securityfocus.com/bid/14063/info ASPNuke is prone to an HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker may exploit this vulnerability to influence or misrepresent how Web...
ASPNuke 0.80 - Language_Select.asp HTTP Response Splitting
ASPNuke 0.80 - LanguageSelect.asp HTTP Response Splitting source: https://www.securityfocus.com/bid/14063/info ASPNuke is prone to an HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker may exploit th...
Just William's Amazon Webstore - HTTP Response Splitting
source: https://www.securityfocus.com/bid/13428/info Amazon Webstore is prone to a HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker may exploit this vulnerability to influence or misrepresent how W...
Mac OS X Security Update 2005-004
The remote host is missing Security Update 2005-004. This security update contains security fixes for the following application : - iSync local privilege escalation TRUSTED...
SqWebMail 3.x4.0 - HTTP Response Splitting
SqWebMail 3.x4.0 - HTTP Response Splitting source: https://www.securityfocus.com/bid/13374/info SQWebmail is prone to a HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker may exploit this vulnerabili...
Mozilla Suite/Firefox/Thunderbird - Nested Anchor Tag Status Bar Spoofing
source: https://www.securityfocus.com/bid/12798/info Mozilla Suite/Firefox and Thunderbird are reported prone to a URI obfuscation weakness. The issue is reported to manifest when 'Save Link As...' functionality is invoked on an malicious anchor tag. This issue may be leveraged by an attacker to...
CVE-2004-1756
BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers...
Install source spoofing with user:pass@host — Mozilla
The installation confirmation dialog shows the source of the software. By adding a long, fake "user:pass" in front of the true hostname the user might be convinced to trust software that comes from an untrustworthy source. This is similar to attempts used in some phishing mail:...