CVE-2001-1278

Zope vulnerable before 2.2.4: partially trusted users could bypass security checks by invoking methods via the fmt attribute of dtml-var tags. The Mandrake MDKSA-2001:080 hotfix addresses this DTML scripting issue, remedying the fmt access problem and preventing unauthorized method calls. The vul...

Buffer overflow in Winamp

Buffer overflow on MP3 ID3v2 tag processing...

Ultimate PHP Board 1.01.1 - Image Tag Script Injection

Ultimate PHP Board 1.01.1 - Image Tag Script Injection source: https://www.securityfocus.com/bid/4603/info Ultimate PHP Board UPB is web forum software. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. Ultimate PHP Board does not filter script code from...

Ultimate PHP Board 1.0/1.1 - Image Tag Script Injection

source: https://www.securityfocus.com/bid/4603/info Ultimate PHP Board UPB is web forum software. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. Ultimate PHP Board does not filter script code from image tags. This may allow an attacker to include scri...

PostBoard 2.0 - BBCode IMG Tag Script Injection

PostBoard 2.0 - BBCode IMG Tag Script Injection source: https://www.securityfocus.com/bid/4559/info PostBoard is a freely available, open source message board module for the PostNuke content management system. It is designed for use on the Unix and Linux operating systems. PostBoard does not...

XGB Guestbook 1.2 - User-Embedded Scripting

source: https://www.securityfocus.com/bid/4513/info xGB is guestbook software. It is written in PHP and will run on most Unix and Linux variants as well as Microsoft Windows operating systems. xGB allows users to post images in guestbook entries by using special syntax to denote a link to an imag...

CVE-2002-0077

Microsoft Internet Explorer 5.01, 5.5 and 6.0 treats objects invoked on an HTML page with the codebase property as part of Local Computer zone, which allows remote attackers to invoke executables present on the local system through objects such as the popup object, aka the "Local Executable...

CSS in ikonboard 3.0.1,3.0.2,3.0.3

author: Maxspeed vendor statues: they have been informed Vulnerable versions: ikonboard 3.0.1 ikonboard 3.0.2 ikonboard 3.0.3the version they use on their site Severity: Malicious users can steal session cookies, allowing administrative access to the admin panel Problem: Ok the problem is in the...

CVE-2001-1157

Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via 1 an extra leading and one or more characters before the SCRIPT tag, or 2 tags using Unicode...

Snitz Forums 2000 3.03.13.3 - Image Tag Cross-Agent Scripting

Snitz Forums 2000 3.03.13.3 - Image Tag Cross-Agent Scripting source: https://www.securityfocus.com/bid/4192/info Snitz Forums 2000 is ASP-based web forum software. It runs on Microsoft Windows operating systems. Snitz Forums 2000 allows users to include images in forum messages using image tags,...

IkonBoard 2.17/3.0/3.1 - Image Tag Cross-Agent Scripting

source: https://www.securityfocus.com/bid/4182/info Ikonboard is a Web Bulletin Board Service BBS software package written in Perl which runs on Unix and Linux variants. Ikonboard allows users to include images in forum messages using image tags, with the following syntax: imgurl of image/img It ...

Open Bulletin Board javascript bug.

OpenBB is free php-based forum. Exploit: imgjavasCript:alert'Hello world.'/img Vulnerable systems: All versions of Open Bulletin Board including v.1.0.0 Immune systems: None Solution: All url's in img tags should start with "http://" Yurij Rumiantsev...

XMB Forum 1.6 pre-beta - Image Tag Script Injection

XMB Forum 1.6 pre-beta - Image Tag Script Injection source: https://www.securityfocus.com/bid/4167/info The Extreme Message Board XMB 1.6 Magic Lantern pre-beta version reportedly allows JavaScript and HTML to be entered in messages. This can be achieved by entering script or HTML between img and...

CVE-2001-1004

Cross-site scripting CSS vulnerability in gnut Gnutella client before 0.4.27 allows remote attackers to execute arbitrary script on other clients by sharing a file whose name contains the script tags...

Дырки в Ultimate Bulletin Board (javascript, cookie)

Можно вставить javascript в таг IMG, кроме того при проверке куки не проверяется пароль пользователя...

Web-based email services filtering systems vulnerable to malicous script execution

Overview An attacker can send a specially crafted email message to a victim containing malicious scripting JavaScript, VBScript, JScript, etc., or potentially HTML. When a victim views the message with scripting enabled, the victim's browser will then interpret this javascript which can lead to...

CVE-2001-0999

Outlook Express 6.00 allows remote attackers to execute arbitrary script by embedding SCRIPT tags in a message whose MIME content type is text/plain, contrary to the expected behavior that text/plain messages will not run script...

CVE-1999-1522

Vulnerability in htmlparse.pike in Roxen Web Server 1.3.11 and earlier, possibly related to recursive parsing and referer tags in RXML...

javascript в gnut (javascript injection)

Имя разделяемого файла может содержать html-таги...

CVE-2001-0519

Aladdin eSafe Gateway versions 2.x allows a remote attacker to circumvent HTML SCRIPT filtering via a special arrangement of HTML tags which includes SCRIPT tags embedded within other SCRIPT tags...