8632 matches found
Web Slider 0.6 - 'path' Remote File Inclusion
Web Slider 0.6pathRemote File Inclusion Vulnerabilities D.Script: http://sourceforge.net/projects/webslider/ Discovered by: GolDM = Mahmoodali Homepage: http://Www.Tryag.Com/cc Exploit:Path/index.php?path=Shell Exploit:Path/modules/pdf.php?path=Shell Exploit:Path/plugins/highlight.php?path=Shell...
PHP 5.2.0 (OSX) - 'header()' Space Trimming Buffer Underflow
?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...
security flaw
A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an 1 img, 2 link, or 3 style tag, which...
MOPB-18-2007:PHP ext/filter HTML Tag Stripping Bypass Vulnerability
Summary Since PHP 5.2.0 there is a new filtering extension in PHP that is on the one hand supposed to be used by applications to filter user input and on the other hand able to enforce site wide filtering. When the FILTERSANITIZESTRING filter is used in combination with the flag FILTERFLAGSTRIPLO...
Privilege escalation by setting img.src to javascript: URI — Mozilla
mozbugra4 reports that the fix for MFSA 2006-72 in Firefox 1.5.0.9 and Firefox 2.0.0.1 introduced a regression that allows scripts from web content to execute arbitrary code by setting the src attribute of an IMG tag to a specially crafted javascript: URI...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in MailEnable Professional before 2.37 allows remote attackers to modify arbitrary configurations and perform unauthorized actions as arbitrary users via a link or IMG tag...
CVE-2007-0652
Cross-site request forgery CSRF vulnerability in MailEnable Professional before 2.37 allows remote attackers to modify arbitrary configurations and perform unauthorized actions as arbitrary users via a link or IMG tag...
CVE-2006-6987
Cross-domain vulnerability in FineBrowser Freeware 3.2.2 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target...
CVE-2006-6986
Cross-domain vulnerability in PhaseOut 5.4.4 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which...
CVE-2006-6990
Cross-domain vulnerability in Enigma Browser 3.8.8 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site,...
CVE-2006-6991
Cross-domain vulnerability in Fast Browser Pro 8.1 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site,...
CVE-2006-6988
Cross-domain vulnerability in Slim Browser 4.07 build 100 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target...
CVE-2006-6987
Cross-domain vulnerability in FineBrowser Freeware 3.2.2 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target...
CVE-2006-6992
Cross-domain vulnerability in GoSuRF Browser 2.62 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site,...
CVE-2006-6989
Cross-domain vulnerability in NetCaptor 4.5.7 Personal Edition allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the...
CVE-2006-6986
PhaseOut 5.4.4 is affected by a cross-domain information disclosure vulnerability. An attacker can cause an object element to reference a URL on the attacker’s site which returns a Location header pointing to the target site; the target content then becomes accessible via the outerHTML attribute ...
CVE-2006-6987
The CVE-2006-6987 entry describes a cross-domain information disclosure in FineBrowser Freeware 3.2.2 via an object tag using a data parameter that points to a page on the attacker’s site, which specifies a Location header referencing the target site and makes content available through the object...
CVE-2006-6984
The CVE-2006-6984 entry concerns GreenBrowser 3.4.0622 and describes a cross-domain information disclosure vulnerability. An attacker can cause the browser to reveal restricted content from a target domain by using an object tag with a data parameter referencing a link on the attacker’s site that...
CVE-2006-6992
Technical details about CVE-2006-6992 are not publicly available in the provided documents. Monitor for updates to confirm affected products, root cause, impact, and remediation.
CVE-2006-6983
CVE-2006-6983 documents a cross-domain information disclosure in MYweb4net Browser 3.8.8.0. The vulnerability arises from an object tag with a data parameter referencing a link that points to a Location header on the attacker's site, allowing the target content to be exposed via the outerHTML att...