RSS-aggregator SQL注入漏洞

BUGTRAQ ID: 30016 CNCAN ID：CNCAN-2008070102 RSS-aggregator是一款基于PHP的WEB应用程序。 RSS-aggregator不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题是脚本对用户提交给WEB参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 RSS-aggregator 1.0 目前没有详细解决方案提供： http://www.rss-aggregator.com/...

Unfixed XSS vulnerability at www.flybalaton.com

Security researcher xylitol, has submitted on 06/10/2008 a cross-site-scripting XSS vulnerability affecting www.flybalaton.com, which at the time of submission ranked 2333856 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/09/2009. It is...

Unfixed XSS vulnerability at www.weberdavisutahhomes.com

Security researcher mckt, has submitted on 06/10/2008 a cross-site-scripting XSS vulnerability affecting www.weberdavisutahhomes.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/10/2008. It is...

Unfixed XSS vulnerability at www.sunnysouthfloridarealestate.com

Security researcher mckt, has submitted on 06/10/2008 a cross-site-scripting XSS vulnerability affecting www.sunnysouthfloridarealestate.com, which at the time of submission ranked 9514973 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on...

Unfixed XSS vulnerability at www.jachtklubas.lt

Security researcher F3nix, has submitted on 06/01/2008 a cross-site-scripting XSS vulnerability affecting www.jachtklubas.lt, which at the time of submission ranked 3269275 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/01/2008. It is...

Unfixed XSS vulnerability at biblioteca.carregal-digital.pt

Security researcher BackDoor, has submitted on 20/05/2008 a cross-site-scripting XSS vulnerability affecting biblioteca.carregal-digital.pt, which at the time of submission ranked 5664707 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on...

Unfixed XSS vulnerability at www.jesper.nu

Security researcher kylex, has submitted on 05/06/2008 a cross-site-scripting XSS vulnerability affecting www.jesper.nu, which at the time of submission ranked 14252 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/06/2008. It is currently...

Unfixed XSS vulnerability at www.enlaces.cl

Security researcher sl4xUz, has submitted on 05/05/2008 a cross-site-scripting XSS vulnerability affecting www.enlaces.cl, which at the time of submission ranked 36076 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/05/2008. It is currently...

Unfixed XSS vulnerability at www.ekontaktas.lt

Security researcher F3nix, has submitted on 21/02/2008 a cross-site-scripting XSS vulnerability affecting www.ekontaktas.lt, which at the time of submission ranked 38917 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/03/2008. It is currentl...

Mozilla Firefox < 2.0.0.12 Multiple Vulnerabilities

Binary data 4365.prm...

URL token stealing via stylesheet redirect — Mozilla

Security researcher Martin Straka reported that Gecko-based browsers update the .href property of stylesheet DOM nodes to reflect the final URI of the stylesheet after following any 302 redirects much as the document.location property is updated. This differs from other browsers and could...

Unfixed XSS vulnerability at antena1.ro

Security researcher Shocker -at- ShockingSoft.com, has submitted on 02/06/2008 a cross-site-scripting XSS vulnerability affecting antena1.ro, which at the time of submission ranked 19888 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/11/200...

Unfixed XSS vulnerability at www.fawri.dz

Security researcher t0fx, has submitted on 13/01/2008 a cross-site-scripting XSS vulnerability affecting www.fawri.dz, which at the time of submission ranked 200838 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 14/01/2008. It is currently...

digitalhive-sql.txt

body margin:3%; font-size:10px; color:FFFFFF; font-family:Verdana,Arial; background-color:1a1a1a; text-align: center; input background:303030; color:FFFFFF; font-family:Verdana,Arial; font-size:10px; vertical-align:middle; border-left:1px solid 5d5d5d; border-right:1px solid 121212;...

Unfixed XSS vulnerability at www.haaretz.com

Security researcher TreX, has submitted on 21/12/2007 a cross-site-scripting XSS vulnerability affecting www.haaretz.com, which at the time of submission ranked 8645 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/12/2007. It is currently...

Unfixed XSS vulnerability at vip-seek.info

Security researcher Genocide, has submitted on 29/11/2007 a cross-site-scripting XSS vulnerability affecting vip-seek.info, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/12/2007. It is currently...

Unfixed XSS vulnerability at www.aladin.wrlc.org

Security researcher Genocide, has submitted on 27/11/2007 a cross-site-scripting XSS vulnerability affecting www.aladin.wrlc.org, which at the time of submission ranked 132714 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is...

CVE-2007-5631

Multiple PHP remote file inclusion vulnerabilities in PeopleAggregator 1.2pre6, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the currentblockmodulepath parameter to 1 AudiosMediaGalleryModule/AudiosMediaGalleryModule.php, 2...

webif-xss.txt

----------------------------- || WWW.SMASH-THE-STACK.NET || ----------------------------- || ADVISORY: IFNET.IT WEBIF XSS VULNERABILITY || 0x00: ABOUT ME || 0x01: DATELINE || 0x02: INFORMATION || 0x03: EXPLOITATION || 0x04: GOOGLE DORK || 0x05: RISK LEVEL || 0x00: ABOUT ME Author: SkyOut Date:...

Unfixed XSS vulnerability at gwar.org.ru

Security researcher iD - uNkn0wn.eu, has submitted on 26/09/2007 a cross-site-scripting XSS vulnerability affecting gwar.org.ru, which at the time of submission ranked 1453096 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/10/2007. It is...