PT-2006-6734 · Baalasp · Baalasp Forum

Name of the Vulnerable Software and Affected Versions: BaalAsp forum affected versions not specified Description: The issue concerns multiple cross-site scripting XSS vulnerabilities in the addpost1.asp file of the BaalAsp forum. These vulnerabilities allow remote attackers to inject arbitrary we...

CVE-2006-6089: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in addpost1.asp in BaalAsp forum allow remote attackers to inject arbitrary web script or HTML via the 1 title Subject, 2 groupname Group Name, or 3 detail Message field...

CVE-2006-6030

Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd Password fields in a admin/default.asp; or the 3 Event Title, 4 Location, or 5 Description field when making a search engine query in b search.asp...

Stanford university SCARF user editing

vendor:Someone at Stanford university site:http://sourceforge.net/projects/scarf/ vuln: There is no admin check on the file generaloptions.php So anyone can go in and make some changes. One thing to do would be create a user, then go into general options and change your user to an admin. You can...

CVE-2006-5713: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Easy File Sharing EFS Web Server 4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 author, 2 content, or 3 title parameters when posting a forum thread. NOTE: the provenance of this information is unknown; the details are obtain...

IBM Client Security passwords manager unauthroized access

Password for site is stored based on site's title instead of URL...

Security flaw in IBM Client Security Password Manager

Hello all, I recently found a security flaw in the design of the IBM Client Security Password Manager an application used to authenticate application forms using fingerprints. It came to my attention that the application only recognized my e-bank site and authed against it if i had just created a...

CVE-2006-5161: Undefined Security Weakness

IBM Client Security Password Manager stores and distributes saved passwords based upon the title of a website, which allows remote attackers to obtain username and password credentials by changing the title of an HTML page...

CVE-2006-5130: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in ph03y3nk just another flat file JAF CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 url, 3 title, and 4 about parameters in a forum post. NOTE: the provenance of this information is unknown; the detai...

CVE-2006-4949

Cross-site scripting XSS vulnerability in the Drupal 4.6 Site Profile Directory profilepages.module before 1.1.2.1 and the Drupal 4.7 Site Profile Directory profilepages.module before 1.2.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "lack o...

CVE-2006-4829: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in David Czarnecki Blojsom 2.31 allow remote attackers to inject arbitrary web script or HTML via the 1 blog-category-description, 2 blog-entry-title, 3 rss-enclosure-url, 4 technorati-tagsi, or 5 blog-category-name parameter in a blog post...

CVE-2006-4660: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll allow remote attackers to process arbitrary web script or HTML in the Feeds interface context via the 1 title and 2 description elements within an item element in an...

CVE-2006-4327: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in addurl.php in CloudNine Interactive Links Manager 2006-06-12 allow remote attackers to inject arbitrary web script or HTML via the 1 title, 2 description, or 3 keywords parameters...

CVE-2006-4106

Cross-site scripting XSS vulnerability in blursoft blur6ex 0.3 allows remote attackers to inject arbitrary web script or HTML via a comment title...

CVE-2006-4106

The CVE-2006-4106 entry documents a Cross-site Scripting (XSS) vulnerability in blursoft blur6ex 0.3, exploitable by remote attackers to inject arbitrary web script or HTML via a comment title. The affected component is the blur6ex 0.3 product; the root cause is improper sanitization of the comme...

CVE-2006-4106

Cross-site scripting XSS vulnerability in blursoft blur6ex 0.3 allows remote attackers to inject arbitrary web script or HTML via a comment title...

CVE-2006-4106: Undefined Security Weakness

Cross-site scripting XSS vulnerability in blursoft blur6ex 0.3 allows remote attackers to inject arbitrary web script or HTML via a comment title...

CVE-2006-4042: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 title, 2 url, 3 excerpt, or 4 blogname parameters...

CVE-2006-3514: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in admin/actions.php in PHP-Blogger 2.2.5, and possibly earlier versions, allow remote attackers to execute arbitrary web script or HTML via the 1 name, 2 title, 3 news, 4 description, and 5 sitename parameters...

CVE-2006-3472: Undefined Security Weakness

Microsoft Internet Explorer 6.0 and 6.0 SP1 allows remote attackers to cause a denial of service via an HTML page with an A tag containing a long title attribute. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...