CVE-2008-5718

The papd daemon in Netatalk before 2.0.4-beta2, when using certain variables in a pipe command for the print file, allows remote attackers to execute arbitrary commands via shell metacharacters in a print request, as demonstrated using a crafted Title...

CVE-2008-5718: Improper Neutralization of Special Elements used in an OS Command

The papd daemon in Netatalk before 2.0.4-beta2, when using certain variables in a pipe command for the print file, allows remote attackers to execute arbitrary commands via shell metacharacters in a print request, as demonstrated using a crafted Title...

CVE-2008-5432

Cross-site scripting XSS vulnerability in Moodle before 1.6.8, 1.7 before 1.7.6, 1.8 before 1.8.7, and 1.9 before 1.9.3 allows remote attackers to inject arbitrary web script or HTML via a Wiki page name aka page title...

Unfixed XSS vulnerability at www.workingtitlefilms.com

Security researcher PaPPy, has submitted on 11/06/2008 a cross-site-scripting XSS vulnerability affecting www.workingtitlefilms.com, which at the time of submission ranked 349144 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 15/06/2008. It is...

CVE-2008-4805

Multiple cross-site scripting XSS vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via 1 the community title, 2 API input, and vectors related to the 3 Homepage, 4 Blogs, 5 Profiles, 6 Dogear, 7 Activities, and 8 Global Search...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via 1 the community title, 2 API input, and vectors related to the 3 Homepage, 4 Blogs, 5 Profiles, 6 Dogear, 7 Activities, and 8 Global Search...

CVE-2008-4805: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via 1 the community title, 2 API input, and vectors related to the 3 Homepage, 4 Blogs, 5 Profiles, 6 Dogear, 7 Activities, and 8 Global Search...

CVE-2008-4688: Exposure of Sensitive Information to an Unauthorized Actor

core/stringapi.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified issue number...

Cross site scripting

Cross-site scripting XSS vulnerability in the Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2008-4152: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via a node title...

Stack overflow

Stack-based buffer overflow in Acoustica Beatcraft 1.02 Build 19 allows user-assisted attackers to cause a denial of service or execute arbitrary code via a Beatcraft Project aka bcproj file with a long string in a certain instruments title field...

Google Chrome 'SaveAs'功能'Title'标签缓冲区溢出漏洞

BUGTRAQ ID: 31029 CNCAN ID：CNCAN-2008090604 Google Chrome是一款谷歌公司新开发的WEB浏览器。 Google Chrome处理"SaveAs"函数时存在边界错误检查问题，远程攻击者可以利用漏洞进行缓冲区溢出攻击，可能以应用程序权限执行任意指令。 构建包含超长标题的title标签HTML页，诱使用户保存此页面时，可触发缓冲区溢出，精心构建标题数据，可导致以应用程序权限执行任意指令。 Google Chrome 0.2.149 27 目前没有解决方案提供： http://www.google.com/chrome...

default config values restored

This should be for 2.9.1 - this version was not yet available under "affects versions" when filing this bug. After updating from 2.9 to 2.9.1, most of my settings were overwritten by their default values. - public signup got enabled - the language changed back to english instead of german - e-mai...

default config values restored

This should be for 2.9.1 - this version was not yet available under "affects versions" when filing this bug. After updating from 2.9 to 2.9.1, most of my settings were overwritten by their default values. - public signup got enabled - the language changed back to english instead of german - e-mai...

default config values restored

This should be for 2.9.1 - this version was not yet available under "affects versions" when filing this bug. After updating from 2.9 to 2.9.1, most of my settings were overwritten by their default values. - public signup got enabled - the language changed back to english instead of german - e-mai...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTML via 1 the real name field, related to the user list; 2 the target parameter to login.php, 3 the title parameter to activities/some.php, 4 the companyname parameter to...

CVE-2008-3937

Multiple cross-site scripting XSS vulnerabilities in Open Media Collectors Database OpenDb 1.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 userid parameter in an edit action to useradmin.php, the 2 title parameter to listings.php, and the 3 redirecturl parameter to...

PT-2008-5267 · Opendb · Opendb

Name of the Vulnerable Software and Affected Versions: OpenDb version 1.0.6 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the user id parameter in an edit action to "user admin.php", the title parameter to "listings.php", and the...

CVE-2008-3937: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open Media Collectors Database OpenDb 1.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 userid parameter in an edit action to useradmin.php, the 2 title parameter to listings.php, and the 3 redirecturl parameter to...

CVE-2008-3773: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a private message subject aka newpmtitle...