CVE-2010-0664

Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/childprocesssecuritypolicy.cc in Google Chrome before 4.0.249.78 allows remote attackers to cause a denial of service memory consumption and application crash via a URL that specifies multiple...

CVE-2009-2945

weblogin/login.fcgi aka the WebLogin login script in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by reading 1 web-serve...

Security expert: do not ignore the URL vulnerability-vulnerability warning-the black bar safety net

Some time ago, the public security organs cracked a network company program theft cases, the analysis a bit, the main problem still lies in URL vulnerability. To test whether the presence of the URL vulnerabilities, the most simple method is in the Request. QueryString added to a’, as shown in th...

Unfixed XSS vulnerability at www.aws.com

Security researcher JonStockton, has submitted on 07/03/2009 a cross-site-scripting XSS vulnerability affecting www.aws.com, which at the time of submission ranked 467423 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 14/06/2010. It is current...

CVE-2009-1835

Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 associate local documents with external domain names located after the file:// substring in a URL, which allows user-assisted remote attackers to read arbitrary cookies via a crafted HTML document, as demonstrated by a URL with...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a 1 save or 2 view script in the SRC attribut...

Unfixed XSS vulnerability at www.chicken.org.au

Security researcher gudgip, has submitted on 24/04/2009 a cross-site-scripting XSS vulnerability affecting www.chicken.org.au, which at the time of submission ranked 2122647 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/07/2009. It is...

CVE-2009-0443

CVE-2009-0443 : A stack-based buffer overflow in Elecard AVC HD PLAYER 5.5.90116 allows remote attackers to execute arbitrary code via an M3U file containing a long string in a URL. Affected software is Elecard AVC HD PLAYER 5.5.90116. The underlying cause is a stack overflow triggered by a long ...

CVE-2008-5334

PHP remote file inclusion vulnerability in includes/common.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary PHP code via a URL in the root parameter...

CVE-2008-5053

PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader comrssreader 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

Unfixed XSS vulnerability at www.dokeswick.com

Security researcher SaMTHG, has submitted on 28/10/2008 a cross-site-scripting XSS vulnerability affecting www.dokeswick.com, which at the time of submission ranked 4374970 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/09/2009. It is...

CVE-2008-3061

CVE-2008-3061: Open redirect vulnerability in redirect.php of V-webmail 1.5.0 allows remote attackers to redirect users to arbitrary sites via the to parameter, enabling phishing. Root cause: open redirect due to insufficient redirection validation. No patch/mitigation details are provided in the...

Hidden pages' content can be viewed without permission using diffpages.action

If the id of a page is known by a user, that user can view the content of the page without having permissions to the space it is in. They need only construct the right URL. EG: Two spaces A and B Page with id 1 is in Space A Page with id 2 is in Space B User cannot see Space A User can see Space ...

Hidden pages' content can be viewed without permission using diffpages.action

If the id of a page is known by a user, that user can view the content of the page without having permissions to the space it is in. They need only construct the right URL. EG: Two spaces A and B Page with id 1 is in Space A Page with id 2 is in Space B User cannot see Space A User can see Space ...

Hidden pages' content can be viewed without permission using copypage.action

If the id of a page is known by a user, that user can view the content of the page without having permissions to the space it is in. They need only construct the right URL. EG: Two spaces A and B Page with id 1 is in Space A User cannot see Space A User can see Space B The following URL will allo...

Unfixed XSS vulnerability at www.rom.on.ca

Security researcher austinator, has submitted on 15/08/2008 a cross-site-scripting XSS vulnerability affecting www.rom.on.ca, which at the time of submission ranked 191693 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/08/2008. It is...

CVE-2008-3678

Cross-site scripting XSS vulnerability in admin/searchlinks.php in Freeway before 1.4.2.197 allows remote attackers to inject arbitrary web script or HTML via the URL...

Unfixed XSS vulnerability at beta.alcoa.com

Security researcher BlueMax, has submitted on 08/11/2008 a cross-site-scripting XSS vulnerability affecting beta.alcoa.com, which at the time of submission ranked 111691 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/09/2009. It is currentl...

Unfixed XSS vulnerability at www.jeans-online.pl

Security researcher zprian, has submitted on 23/07/2008 a cross-site-scripting XSS vulnerability affecting www.jeans-online.pl, which at the time of submission ranked 45606 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 26/07/2008. It is...

Unfixed XSS vulnerability at www.theeuropeanlibrary.org

Security researcher Futility, has submitted on 27/06/2008 a cross-site-scripting XSS vulnerability affecting www.theeuropeanlibrary.org, which at the time of submission ranked 369525 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/07/2008. I...