436 matches found
Outlook Web Access URL Injection
Due to a lack of sanitization of the user input, the remote version of Microsoft Outlook Web Access 2003 is vulnerable to URL injection which can be exploited to redirect a user to a different, unauthorized web server after authenticating to OWA. SPDX-FileCopyrightText: 2005 Michael J. Richardson...
IIS XSS via IDC error
This IIS Server appears to be vulnerable to a Cross Site Scripting due to an error in the handling of overlong requests on an idc file. It is possible to inject Javascript in the URL, that will appear in the resulting page. OpenVAS Vulnerability Test $Id: iisxssidc.nasl 9087 2018-03-12 17:24:24Z...
Microsoft IIS 'IDC error' XSS Vulnerability - Active Check
This IIS Server appears to be vulnerable to a Cross Site Scripting due to an error in the handling of overlong requests on an idc file. It is possible to inject Javascript in the URL, that will appear in the resulting page. SPDX-FileCopyrightText: 2002 Geoffroy Raimbault/Lynx Technologies Some te...
CVE-2004-2119
The CVE-2004-2119 entry documents a Cross-site scripting (XSS) vulnerability in Tiny Server 1.1, where an attacker can inject arbitrary web script or HTML via the URL. The vulnerability affects Tiny Server 1.1’s URL handling and has a base severity of MEDIUM (CVSS v2: 4.3) with network attack vec...
CVE-2005-1555
CVE-2005-1555 affects the JRun Web Server component of ColdFusion MX 7.0. The vulnerability is a cross-site scripting (XSS) flaw where an attacker can inject arbitrary script or HTML through the request URL because the URL is not properly quoted in the server’s default 404 error page. This is a c...
CVE-2005-1555
Cross-site scripting XSS vulnerability in the JRun Web Server in ColdFusion MX 7.0 allows remote attackers to inject arbitrary script or HTML via the URL, which is not properly quoted in the resulting default 404 error page...
CVE-2004-1807
Cross-site scripting XSS vulnerability in index.cfm in CFWebstore 5.0 allows remote attackers to inject arbitrary web script or HTML via the URL...
Microsoft Outlook Web Access (OWA) owalogon.asp Redirection Account Enumeration
The remote host is running Microsoft Outlook Web Access OWA 2003. Due to a lack of sanitization of the user input, the remote version of this software is vulnerable to URL injection that can be exploited to redirect a user to a different, unauthorized web server after authenticating to OWA. This...
CVE-2004-1229
Cross-site scripting vulnerability in the parser for Gadu-Gadu allows remote attackers to inject arbitrary web script or HTML via 1 http:// or 2 news:// URLs, a different vulnerability than CVE-2004-1410...
[Full-Disclosure] Lotus Notes URL argument injection vulnerability
OVERVIEW ======== Lotus Notes is a groupware/e-mail system developed by Lotus Software. Due to its security and collaboration features it's used particularly by large organizations, government agencies, etc. IBM estimates it is used by 60 million people. During the client-side Windows installatio...
Microsoft Internet Explorer - URL Injection in History List (MS04-004)
// Andreas Sandblad, 2004-02-03, patched by MS04-004 // Name: payload // Purpose: Run payload code called from Local Machine zone. // The code may be arbitrary such as executing shell commands. // This demo simply creates a harmless textfile on the desktop. function payload file = "sandblad.txt";...
Microsoft Internet Explorer - URL Injection in History List (MS04-004)
Microsoft Internet Explorer - URL Injection in History List MS04-004 // Andreas Sandblad, 2004-02-03, patched by MS04-004 // Name: payload // Purpose: Run payload code called from Local Machine zone. // The code may be arbitrary such as executing shell commands. // This demo simply creates a...
MS Internet Explorer URL Injection in History List (MS04-004)
Exploit for unknown platform in category remote exploits ============================================================= MS Internet Explorer URL Injection in History List MS04-004 ============================================================= // Andreas Sandblad, 2004-02-03, patched by MS04-004 //...
CVE-2002-2273
Cross-site scripting XSS vulnerability in Webster HTTP Server allows remote attackers to inject arbitrary web script or HTML via the URL...
