CVE-2009-1835

Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 associate local documents with external domain names located after the file:// substring in a URL, which allows user-assisted remote attackers to read arbitrary cookies via a crafted HTML document, as demonstrated by a URL with...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a 1 save or 2 view script in the SRC attribut...

Unfixed XSS vulnerability at www.chicken.org.au

Security researcher gudgip, has submitted on 24/04/2009 a cross-site-scripting XSS vulnerability affecting www.chicken.org.au, which at the time of submission ranked 2122647 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/07/2009. It is...

CVE-2009-0443

CVE-2009-0443 : A stack-based buffer overflow in Elecard AVC HD PLAYER 5.5.90116 allows remote attackers to execute arbitrary code via an M3U file containing a long string in a URL. Affected software is Elecard AVC HD PLAYER 5.5.90116. The underlying cause is a stack overflow triggered by a long ...

CVE-2008-5334

PHP remote file inclusion vulnerability in includes/common.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

CVE-2008-5053

PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader comrssreader 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

Unfixed XSS vulnerability at www.dokeswick.com

Security researcher SaMTHG, has submitted on 28/10/2008 a cross-site-scripting XSS vulnerability affecting www.dokeswick.com, which at the time of submission ranked 4374970 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/09/2009. It is...

CVE-2008-3061

CVE-2008-3061: Open redirect vulnerability in redirect.php of V-webmail 1.5.0 allows remote attackers to redirect users to arbitrary sites via the to parameter, enabling phishing. Root cause: open redirect due to insufficient redirection validation. No patch/mitigation details are provided in the...

Hidden pages' content can be viewed without permission using diffpages.action

If the id of a page is known by a user, that user can view the content of the page without having permissions to the space it is in. They need only construct the right URL. EG: Two spaces A and B Page with id 1 is in Space A Page with id 2 is in Space B User cannot see Space A User can see Space ...

Hidden pages' content can be viewed without permission using diffpages.action

If the id of a page is known by a user, that user can view the content of the page without having permissions to the space it is in. They need only construct the right URL. EG: Two spaces A and B Page with id 1 is in Space A Page with id 2 is in Space B User cannot see Space A User can see Space ...

Hidden pages' content can be viewed without permission using copypage.action

If the id of a page is known by a user, that user can view the content of the page without having permissions to the space it is in. They need only construct the right URL. EG: Two spaces A and B Page with id 1 is in Space A User cannot see Space A User can see Space B The following URL will allo...

Unfixed XSS vulnerability at www.rom.on.ca

Security researcher austinator, has submitted on 15/08/2008 a cross-site-scripting XSS vulnerability affecting www.rom.on.ca, which at the time of submission ranked 191693 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/08/2008. It is...

CVE-2008-3678

Cross-site scripting XSS vulnerability in admin/searchlinks.php in Freeway before 1.4.2.197 allows remote attackers to inject arbitrary web script or HTML via the URL...

Unfixed XSS vulnerability at beta.alcoa.com

Security researcher BlueMax, has submitted on 08/11/2008 a cross-site-scripting XSS vulnerability affecting beta.alcoa.com, which at the time of submission ranked 111691 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/09/2009. It is currentl...

Unfixed XSS vulnerability at www.jeans-online.pl

Security researcher zprian, has submitted on 23/07/2008 a cross-site-scripting XSS vulnerability affecting www.jeans-online.pl, which at the time of submission ranked 45606 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 26/07/2008. It is...

Unfixed XSS vulnerability at www.theeuropeanlibrary.org

Security researcher Futility, has submitted on 27/06/2008 a cross-site-scripting XSS vulnerability affecting www.theeuropeanlibrary.org, which at the time of submission ranked 369525 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/07/2008. I...

Unfixed XSS vulnerability at homemarketplace.resultspage.com

Security researcher PaPPy, has submitted on 19/06/2008 a cross-site-scripting XSS vulnerability affecting homemarketplace.resultspage.com, which at the time of submission ranked 15581 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/06/2009. ...

Unfixed XSS vulnerability at wildseedmusic.com

Security researcher xylitol, has submitted on 06/09/2008 a cross-site-scripting XSS vulnerability affecting wildseedmusic.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/09/2008. It is currently...

Unfixed XSS vulnerability at soldat-tr.com

Security researcher hayaletkral, has submitted on 31/05/2008 a cross-site-scripting XSS vulnerability affecting soldat-tr.com, which at the time of submission ranked 234960 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/07/2008. It is...

XSS vulnerability in create/edit/copy page and blogpost actions

panelThe following create/edit page URL's are vulnerable: - /pages/createpage.action - /pages/docreatepage.action - /pages/editpage.action - /pages/doeditepage.action on parentPageString panel Example of a maliciously crafted path:...