5811 matches found
DSA-531 php4 - several vulnerabilities
Bulletin has no description...
security flaw
The striptags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null \0 characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and...
XSS в разных форумах
Здравствуйте, 3APA3A. играясь с е107 обнаружил следующее: forum проверено на версии 6.12 возможность вставки BBCode URL=http://some.url"style="position:absolute;left:220px;top:10px;"size=14test /size/URL проверенный:...
CVE-2004-0595
The striptags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null \0 characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and...
PHP 4.x5.0 - Strip_Tags() Function Bypass
PHP 4.x5.0 - StripTags Function Bypass source: https://www.securityfocus.com/bid/10724/info It is reported that it is possible to bypass PHPs striptags function. It is reported that under certain circumstances, PHPs striptags function will improperly leave malformed tags in place. This...
PHP 4.x/5.0 - 'Strip_Tags()' Function Bypass
source: https://www.securityfocus.com/bid/10724/info It is reported that it is possible to bypass PHPs striptags function. It is reported that under certain circumstances, PHPs striptags function will improperly leave malformed tags in place. This vulnerability may mean that previously...
[Full-Disclosure] RS-2004-2: "Content-Type" XSS vulnerability affecting other webmail systems
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =============================== - RS-Labs Security Advisory - =============================== Tittle: "Content-Type" XSS vulnerability affecting other webmail systems ID: RS-2004-2 Severity: Medium / High - Arbitrary tags injection in victim's browser...
CVE-2004-0527
CVE-2004-0527 affects KDE Konqueror 2.1.1 and 2.2.2. The issue allows remote attackers to spoof a legitimate URL in the status bar by using A HREF tags with modified alt values that point to the legitimate site, combined with an image map whose href points to the malicious site, enabling a phishi...
CVE-2004-0528: Undefined Security Weakness
Netscape Navigator 7.1 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack...
CVE-2004-0470: Undefined Security Weakness
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remov...
Opera Web Browser 7.0 - Remote IFRAME Denial of Service
Opera Web Browser 7.0 - Remote IFRAME Denial of Service source: https://www.securityfocus.com/bid/10081/info A denial of service vulnerability has been reported to affect Opera Web Browser. The issue is reported to present itself when Opera attempts to render IFRAME HTML tags that contain an...
PHP-Nuke 6.x/7.0/7.1 - Image Tag Admin Command Execution
source: https://www.securityfocus.com/bid/9895/info It has been reported that PHP-Nuke is prone to a remote admin command execution vulnerability. This issue is due to a design error that allows an attacker to specify arbitrary URI values in bbCode tags contained within posts. This issue may be...
YaBBXSS.txt
Advisory Name : YaBB/YaBBse Cross Site Scripting Vulnerability Release Date : Mar 14,2004 Application : YaBB/YaBBse Test On : YaBB 1 GoldSP1.3 YaBB SE 1.5.1 Final Vendor URL : http://www.yabbforum.com/ http://www.yabbse.org/ Discover : Cheng Peng Suapplesoupatmsn.com Proof of conecpt: The problem...
YaBB/YaBBse Cross Site Scripting Vulnerability
Advisory Name : YaBB/YaBBse Cross Site Scripting Vulnerability Release Date : Mar 14,2004 Application : YaBB/YaBBse Test On : YaBB 1 GoldSP1.3 YaBB SE 1.5.1 Final Vendor URL : http://www.yabbforum.com/ http://www.yabbse.org/ Discover : Cheng Peng Suapplesoupatmsn.com Proof of conecpt: The problem...
EZBoard 7.3 - Font Tag HTML Injection
source: https://www.securityfocus.com/bid/9725/info ezboard is prone to an HTML injection vulnerability. An attacker may exploit this issue by including hostile HTML and script code encapsulated in font tags of posts to the bulletin board. This code may be rendered in the web browser of a user wh...
[waraxe-2004-SA#001] - Script injection in GBook for Php-Nuke ver. 1.0
================================================================================ waraxe-2004-SA001 ================================================================================ Script injection in GBook for Php-Nuke ver. 1.0...
CVE-2003-1105
Unknown vulnerability in Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to cause a denial of service browser or Outlook Express crash via HTML with certain input tags that are not properly rendered...
CVE-2003-1278
Cross-site scripting vulnerability XSS in OpenTopic 2.3.1 allows remote attackers to execute arbitrary script as other users and possibly steal authentication information via cookies by injecting arbitrary HTML or script into IMG tags...
Apple QuickTime/Darwin Streaming Server integer overflow in MP3Broadcaster utility
Overview Apple's QuickTime and Darwin Streaming Server DSS package includes a utility called MP3Broadcaster. This utility contains an integer overflow which may be exploited to cause a denial of service. Description Apple's QuickTime and Darwin Streaming Server is software which provides integrat...