JBoss Enterprise Portal Platform多个跨站脚本执行漏洞

BUGTRAQ ID: 57521 CVECAN ID: CVE-2012-5531 JBoss Enterprise Portal Platform是构建和管理动态网站的平台。 JBoss Enterprise Portal Platform 5.2.2内的GateIn Portal中存在多个XSS漏洞，可允许远程攻击者通过特制URL注入任意脚本代码。 0 RedHat Enterprise Portal Platform 5.x 厂商补丁： RedHat ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2012-0017

Cross-site scripting XSS vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in inplview.aspx Vulnerability."...

Minveli SQL Injection

Title : Minveli SQL Injection Vulnerability Author: eXeSoul Home : www.indishell.in or www.andhrahackers.com Email : [email protected] date : 30/3/2011 d0rk:- "Powered by Minveli" category : Web Apps SQli Go To Site :- SQL injection Vulnerability +http://site.com/index1.php?mainmenuid=2'...

CVE-2010-4220

Cross-site scripting XSS vulnerability in the Integrated Solution Console in the Administrative Console component in IBM WebSphere Application Server WAS 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related in part to "URL injection."...

Cross site scripting

Cross-site scripting XSS vulnerability in the Integrated Solution Console in the Administrative Console component in IBM WebSphere Application Server WAS 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related in part to "URL injection."...

CVE-2010-4220

Cross-site scripting XSS vulnerability in the Integrated Solution Console in the Administrative Console component in IBM WebSphere Application Server WAS 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related in part to "URL injection."...

Oracle BPEL Console 10.1.3.3.0 Cross Site Scripting

Digital Security Research Group DSecRG Advisory DSECRG-09-032 Application: Oracle BPEL Console version 10.1.3.3.0 Versions Affected: Oracle BPEL Console version 10.1.3.3.0 Vendor URL: http://www.oracle.com Bugs: XSS Exploits: YES Reported: 18.03.2009 Vendor response: 19.03.2009 Date of Public...

TYPO3 Security Bulletin

It has been discovered that the extension powermail powermail is vulnerable to Cross-Site Scripting, SQL Injection and Validation Bypass Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.5.3 and below Vulnerability...

Unfixed XSS vulnerability at www.mypaste.net

Security researcher nullbyt3, has submitted on 09/07/2010 a cross-site-scripting XSS vulnerability affecting www.mypaste.net, which at the time of submission ranked 319328 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/07/2010. It is...

CVE-2010-2325

Cross-site scripting XSS vulnerability in the administrative console in IBM WebSphere Application Server WAS 7.0 before 7.0.0.11 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related in part to "URL injection."...

CVE-2010-1618

Cross-site scripting XSS vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message...

Sun Java Web Start command-line argument injection

Added: 04/20/2010 CVE: CVE-2010-0886 BID: 39492 OSVDB: 63798 Background Sun Java Web Start allows standalone Java applications, called JNLP files, to be executed by the Java Runtime Environment JRE. Problem A vulnerability in Sun Java Web Start allows execution of arbitrary commands which are...

Sun Java Web Start command-line argument injection

Added: 04/20/2010 CVE: CVE-2010-0886 BID: 39492 OSVDB: 63798 Background Sun Java Web Start allows standalone Java applications, called JNLP files, to be executed by the Java Runtime Environment JRE. Problem A vulnerability in Sun Java Web Start allows execution of arbitrary commands which are...

InterWoven WorkDocs XSS Cross-Site Scripting

Interwoven WorkDocs is a document management tool for the enterprise. There is a cross-site scripting vulnerability within Interwoven WorkDocs. It is possible for a malicious attacker to inject script code into malformed URL which may eventually lead to many different attack scenarios including t...

Microsoft Windows code execution

URL code injection...

CVE-2009-3300

Multiple cross-site scripting XSS vulnerabilities in the Identity Provider IdP 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via...

Adobe ColdFusion <= 8.0.1 _logintowizard.cfm XSS

The version of ColdFusion running on the remote host is affected by a cross-site scripting vulnerability. The 'logintowizard.cfm' and 'index.cfm' scripts do not sanitize the query string of the URL, which can result in the injection of arbitrary HTML or script code. A remote attacker can exploit...

Impact Software AdPeeps 8.5d1 - Cross-Site Scripting HTML Injection

Impact Software AdPeeps 8.5d1 - Cross-Site Scripting HTML Injection AdPeeps Ad Rotator - XSS and HTML Injection Vulnerabilities Version Affected: 8.5d1 3-18-09 newest Info: Ad Peeps is a banner rotator and text ad rotator - all in one that allows you to track, sell and manage banner ads,...

[DSECRG-09-013] IBM WebSphere Application Server 7.0 Multiple XSS Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-013 !!! official advisory: !!! http://dsecrg.com/pages/vul/DSECRG-09-013.html Application: IBM WebSphere Application Server Versions Affected: 7.0 and 6.1 Vendor URL: http://www.ibm.com/websphere/ Bug: Multiple XSS Vulnerabilities Exploits...

Cross site scripting

Cross-site scripting XSS vulnerability in ActionScript in arbitrary Shockwave Flash SWF controller files created by Techsmith Camtasia Studio before 5 allows remote attackers to inject arbitrary additional SWF content via a URL in the csPreloader parameter...