CVE-2008-1888: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML via the Picture Source aka picture object source field in the Rich Text Editor...

Microsoft SharePoint服务器图片源码HTML注入漏洞

BUGTRAQ ID: 28706 SharePoint Server是一个服务器功能集成套件，提供全面的内容管理和企业搜索，加速共享业务流程并简化跨界限信息共享。 SharePoint Services 2.0中存在跨站脚本漏洞，在使用文本编辑器添加图片后保存网页时，没有正确地过滤某些字符串。如果用户的浏览器中启用了JavaScript的话，则在用户查看该网页时就会执行图片源码中所嵌入的脚本。 Microsoft Windows SharePoint Services 2.0 Microsoft ---------...

Programmer's Notepad ctags栈缓冲区溢出漏洞

BUGTRAQ ID: 28119 Programmer's Notepad是免费的开源文本编辑器。 Programmer's Notepad在处理ctags输出时存在栈溢出漏洞，攻击者可能利用此漏洞控制用户系统。 如果用户受骗打开了特制的.c文件并使用了Jump To对话框的话，就可以触发这个溢出，导致执行任意指令。 pnotepad.org Programmer's Notepad 2.0.6.1 pnotepad.org ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2008-0481

Directory traversal vulnerability in RTEfilebrowser.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to list arbitrary directories, and .txt and .zip files, via a .....\\ in the sub parameter in a save action...

Design/Logic Flaw

RTEpopupsavefile.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload 1 .html and 2 .htm files via unspecified vectors...

CVE-2008-0473

Affected software: Web Wiz Rich Text Editor 4.0. Vulnerable component: RTE_popup_save_file.asp. Vulnerability summary: Remote attackers can upload (1) .html and (2) .htm files via unspecified vectors. Root cause (as stated): likely insufficient validation in the file-upload handling. Impact (as s...

CVE-2008-0481

Directory traversal vulnerability in RTEfilebrowser.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to list arbitrary directories, and .txt and .zip files, via a .....\\ in the sub parameter in a save action...

CVE-2008-0481

The CVE-2008-0481 entry concerns Web Wiz Rich Text Editor 4.0, where a directory-traversal flaw in RTE_file_browser.asp allows remote listing of arbitrary directories and .txt/.zip files via a malformed path in the sub parameter of a save action. The root cause is a traversal vulnerability in the...

CVE-2008-0481: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in RTEfilebrowser.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to list arbitrary directories, and .txt and .zip files, via a .....\\ in the sub parameter in a save action...

CVE-2008-0473: Improper Input Validation

RTEpopupsavefile.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload 1 .html and 2 .htm files via unspecified vectors...

CVE-2008-0466: Improper Authentication

Web Wiz RTEfilebrowser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files. NOTE: this can be leveraged for listings outside the configured directory tree ...

wwrte-traverse.txt

WwW.BugReport.ir AmnPardaz Security Research Team Title: Web Wiz Rich Text EditorTM Vendor: http://www.webwizguide.com/ Bug: Directory traversal + HTM/HTML file creation on the server Vulnerable Version: 4.0 Exploit: Available Fix Available: No! Fast Solution is available. - Description: Web Wiz...

Web Wiz Rich Text Editor 4.0 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ Web Wiz Rich Text Editor 4.0 Multiple Remote Vulnerabilities ============================================================ AmnPardaz Security Research Team Title: Web Wiz Rich Tex...

Web Wiz (Multiple Products) - Remote Information Disclosure

source: https://www.securityfocus.com/bid/27419/info Web Wiz Forums, NewsPad, and Rich Text Editor are prone to a remote information-disclosure vulnerability because they fail to properly sanitize user-supplied input. An attacker can exploit this issue to retrieve arbitrary files in the context o...

CVE-2007-6522

The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains...

[SECURITY] Fedora 7 Update: emacs-22.1-5.fc7

Emacs is a powerful, customizable, self-documenting, modeless text editor. Emacs contains special code editing features, a scripting language elisp, and the capability to read mail, news, and more without leaving the editor. This package provides an emacs binary with support for X windows...

[SECURITY] Fedora 8 Update: emacs-22.1-8.fc8

Emacs is a powerful, customizable, self-documenting, modeless text editor. Emacs contains special code editing features, a scripting language elisp, and the capability to read mail, news, and more without leaving the editor. This package provides an emacs binary with support for X windows...

[SECURITY] Fedora 7 Update: kdeutils-3.5.8-2.fc7

Utilities for the K Desktop Environment. Includes: ark tar/gzip archive manager; kcalc scientific calculator; kcharselect character selector; kdepasswd change password; kdessh ssh front end; kdf view disk usage; kedit simple text editor; kfloppy floppy formatting tool; kgpg gpg gui khexedit hex...

CVE-2002-2334

Joe text editor 2.8 through 2.9.7 does not remove the group and user setuid bits for backup files, which could allow local users to execute arbitrary setuid and setgid root programs when root edits scripts owned by other users...

CVE-2002-2334

CVE-2002-2334 affects Joe text editor versions 2.8–2.9.7. Backup files do not have their group and user setuid bits removed, which could allow local users to execute arbitrary setuid/setgid root programs when root edits scripts owned by other users. The NVD CVSS score is 3.6 (LOW) with local atta...