DEBIAN-CVE-2009-4495

Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

DEBIAN-CVE-2009-4487

nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

CVE-2009-4611

Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal...

PT-2010-1349 · Thttpd · Thttpd

Name of the Vulnerable Software and Affected Versions: thttpd version 2.25b0 Description: The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. This is due to thttpd writing...

PT-2010-1350 · Ruby +1 · Ruby +1

Name of the Vulnerable Software and Affected Versions: Ruby versions 1.8.6 through patchlevel 383 Ruby versions 1.8.7 through patchlevel 248 Ruby version 1.8.8dev Ruby versions 1.9.1 through patchlevel 376 Ruby version 1.9.2dev Description: The issue allows remote attackers to potentially modify ...

PT-2010-1346 · Varnish +1 · Varnish +1

Name of the Vulnerable Software and Affected Versions: Varnish version 2.0.6 Description: The issue arises from Varnish writing data to a log file without sanitizing non-printable characters. This could potentially allow remote attackers to modify a window's title or possibly execute arbitrary...

CVE-2009-4491

The thttpd 2.25b0 web server is vulnerable to a command injection flaw because it fails to sanitize non-printable characters in user-supplied input before writing to log files. A remote attacker can exploit this by sending an HTTP request containing terminal escape sequences , which may allow the...

CVE-2009-4601

Cross-site scripting XSS vulnerability in basicsearchresult.php in Zeeways ZeeJobsite 3x allows remote attackers to inject arbitrary web script or HTML via the title parameter...

CVE-2009-4601: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in basicsearchresult.php in Zeeways ZeeJobsite 3x allows remote attackers to inject arbitrary web script or HTML via the title parameter...

SafeCms 2.0.1.0 Cross Site Scripting

Exploit Title: SafeCms Software Link: http://demo.safecms.co.il/ Version: X = 2.0.1.0 Beta XSS http://URL/admin/sendpass.asp?q=%22%3E%3Cscript%3Ealert1%3C/script%3E http://URL/admin/info.asp?q=%E0%22%3E%3Cscript%3Ealert1%3C/script%3E E0F...

Cross site scripting

Cross-site scripting XSS vulnerability in the Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, allows remote authenticated users, with image-node creation privileges, t...

Sql injection

SQL injection vulnerability in index.php in Zenphoto 1.2.5 allows remote attackers to execute arbitrary SQL commands via the title parameter in a news action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-4566: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Zenphoto 1.2.5 allows remote attackers to execute arbitrary SQL commands via the title parameter in a news action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-4557: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, allows remote authenticated users, with image-node creation privileges, t...

CVE-2009-4459

Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...

CVE-2009-4459

Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...

DEBIAN-CVE-2009-4459

Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...

CVE-2009-4459

Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...

CVE-2009-4459: Improper Neutralization of Input During Web Page Generation

Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...

DJ Studio Pro 5.1.6.5.2 - Local Overflow (SEH)

!/usr/bin/ruby Exploit Title : DJ Studio Pro 5.1.6.5.2 SEH Exploit Date : 2009-12-30 Author : Sébastien Duquette - [email protected] Software Link : http://www.e-soft.co.uk/ Version : 5.1.6.5.2 Tested on : Windows XP SP2 En OSVDB ID : 58159 Overflow originally discovered by prodigy exec calc.exe...