phpMyAdmin - Client-Side Code Injection Redirect Link Falsification

phpMyAdmin - Client-Side Code Injection Redirect Link Falsification PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification Credits: Emanuele 'emgent' Gentili Marco 'whitesheep' Rondini Alessandro 'scox' Scoscia In error.php, PhpMyAdmin permit to insert text and restricted tag,...

phpMyAdmin - Client-Side Code Injection / Redirect Link Falsification

PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification Credits: Emanuele 'emgent' Gentili Marco 'whitesheep' Rondini Alessandro 'scox' Scoscia In error.php, PhpMyAdmin permit to insert text and restricted tag, like BBCode. With tag a@url@pageClick Me/a, you can insert your own...

FreeBSD -- Unvalidated input in nfsclient

Problem Description: The NFS client subsystem fails to correctly validate the length of a parameter provided by the user when a filesystem is mounted...

FreeBSD-SA-10:06.nfsclient

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-10:06.nfsclient Security Advisory The FreeBSD Project Topic: Unvalidated input in nfsclient Category: core Module: nfsclient Announced: 2010-05-27 Credits:...

PHP Banner Exchange 1.2 - signupconfirm.php Cross-Site Scripting

PHP Banner Exchange 1.2 - signupconfirm.php Cross-Site Scripting source: https://www.securityfocus.com/bid/40165/info PHP Banner Exchange is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issu...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advancedsearchresult page. NOTE: the provenance of this information is unknown; the details are obtained solely from...

Unfixed XSS vulnerability at www.crazysoft-ppc-games.com

Security researcher cueballr, has submitted on 24/03/2008 a cross-site-scripting XSS vulnerability affecting www.crazysoft-ppc-games.com, which at the time of submission ranked 6776159 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 26/03/2008...

XSS vulnerability: space name and key not validated nor escaped

Email sent from Igor: quote The problem: The input for space name and key is not being validated properly. I created a JIRA for lacking length validation CONF-8894 and later on I noticed that any characters in the input for space name are allowed. Combine that with another batch of bugs - space...

Unfixed XSS vulnerability at www.cookislands.de

Security researcher BackDoor, has submitted on 04/11/2007 a cross-site-scripting XSS vulnerability affecting www.cookislands.de, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/11/2007. It is currentl...

CVE-2007-1188

WebAPP before 0.9.9.5 allows remote attackers to submit Search form input that is not checked for 1 composition or 2 length, which has unknown impact, possibly related to "search form hijacking"...

3editor CMS 0.42 - index.php Local File Inclusion

3editor CMS 0.42 - index.php Local File Inclusion script Name: 3editor CMS index.php Local File Include Exploit Download:http://www.matteolucarelli.net/3editor/index.htm Author : Dr Max Virus Contact :[email protected] Bug & Problem In file index.php Let's Take a look; if !isset$GET'page'...

GLSA-200611-04 : Bugzilla: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200611-04 Bugzilla: Multiple Vulnerabilities The vulnerabilities identified in Bugzilla are as follows: Frederic Buclin and Gervase Markham discovered that input passed to various fields throughout Bugzilla were not properly...

Osprey <= 1.0 GetRecord.php Remote File Include Vulnerability

No description provided by source. --------------------------------------------------------------------------- Osprey = 1.0 libdir Remote File Include Vulnerability --------------------------------------------------------------------------- Discovered By Kw3RLn Romanian Security Team :...

phpunity.postcard (gallery_path) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ================================================================== phpunity.postcard gallerypath Remote File Include Vulnerability ================================================================== phpunity.postcard phpunity-postcard.php...

CVE-2006-4468

Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow attackers to have an unknown impact via unspecified vectors involving the 1 mosMail, 2 JosIsValidEmail, and 3 josSpoofValue functions; 4 the lack of inclusion of globals.php in...

CVE-2006-4468

Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow attackers to have an unknown impact via unspecified vectors involving the 1 mosMail, 2 JosIsValidEmail, and 3 josSpoofValue functions; 4 the lack of inclusion of globals.php in...

CVE-2006-4468

CVE-2006-4468 affects Joomla! prior to 1.0.11. The vulnerability set involves multiple input- handling weaknesses (unvalidated input) across several components: mosMail, JosIsValidEmail, josSpoofValue, missing inclusion of globals.php in administrator/index.php, Admin User Manager, and the poll m...

Dragonfly CMS 9.0.6.1 and prior XSS

HeLiOsZ - Dark End Team - Internet Security Team Dragonfly CMS 9.0.6.1 and prior XSS IRC: darkend.sytes.net darkend , http://darkend.sytes.net & http://www.darkend.org Rish : Medium Type : web applet Creator: http://www.cpgnuke.com/ Exploit: - The vuln is in the search section,it don't validate t...

WebAlbum 2.02pl - COOKIE[skin2] Remote Code Execution

WebAlbum 2.02pl - COOKIEskin2 Remote Code Execution !/usr/bin/php -q -d shortopentag=on this works with magicquotesgpc=Off\r\n"; echo "dork: WEBalbum 2004-2006 duda\r\n"; if $argc 126 $result.=" ."; else $result.=" ".$string$i; if...

FForm Sender 1.0 - 'Processform.php3?Name' Cross-Site Scripting

source: https://www.securityfocus.com/bid/14324/info A cross-site scripting vulnerability affects Form Sender. This issue is due to a failure of the application to properly sanitize user-supplied URI input that will be output in dynamically generated Web pages. This may facilitate the theft of...