6455 matches found
XSS vulnerability: space name and key not validated nor escaped
Email sent from Igor: quote The problem: The input for space name and key is not being validated properly. I created a JIRA for lacking length validation CONF-8894 and later on I noticed that any characters in the input for space name are allowed. Combine that with another batch of bugs - space...
CVE-2007-0041
The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow...
Buffer overflow
The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow...
Unfixed XSS vulnerability at newsletter.software.com.pl
Security researcher GeFORC3, has submitted on 07/05/2007 a cross-site-scripting XSS vulnerability affecting newsletter.software.com.pl, which at the time of submission ranked 474297 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/05/2007. It...
Unfixed XSS vulnerability at www.buscaniguas.com.sv
Security researcher Uber0n, has submitted on 05/12/2007 a cross-site-scripting XSS vulnerability affecting www.buscaniguas.com.sv, which at the time of submission ranked 225048 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/12/2007. It is...
Unfixed XSS vulnerability at www.cookislands.de
Security researcher BackDoor, has submitted on 04/11/2007 a cross-site-scripting XSS vulnerability affecting www.cookislands.de, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/11/2007. It is currentl...
scip-2962.txt
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Wordpress 2.1.1 - Multiple Script Injection Vulnerabilities scip AG Vulnerability ID 2962 02/27/2007 http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2962 I. INTRODUCTION "WordPress is a state-of-the-art semantic personal publishing platform with a focu...
CVE-2007-1188
WebAPP before 0.9.9.5 allows remote attackers to submit Search form input that is not checked for 1 composition or 2 length, which has unknown impact, possibly related to "search form hijacking"...
Hardcoded credentials
The hardware detection functionality in the Windows Shell in Microsoft Windows XP SP2 and Professional, and Server 2003 SP1 allows local users to gain privileges via an unvalidated parameter to a function related to the "detection and registration of new hardware."...
CVE-2007-0211
The hardware detection functionality in the Windows Shell in Microsoft Windows XP SP2 and Professional, and Server 2003 SP1 allows local users to gain privileges via an unvalidated parameter to a function related to the "detection and registration of new hardware."...
KSirc: Denial of Service vulnerability
Background KSirc is the default KDE IRC client. Description KSirc fails to check the size of an incoming PRIVMSG string sent from an IRC server during the connection process. Impact A malicious IRC server could send a long PRIVMSG string to the KSirc client causing an assertion failure and the...
Design/Logic Flaw
The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information the full path via "unvalidated output" in FAQ/index.php, possibly involving an undefined idcat variable...
3editor CMS 0.42 - index.php Local File Inclusion
3editor CMS 0.42 - index.php Local File Inclusion script Name: 3editor CMS index.php Local File Include Exploit Download:http://www.matteolucarelli.net/3editor/index.htm Author : Dr Max Virus Contact :[email protected] Bug & Problem In file index.php Let's Take a look; if !isset$GET'page'...
GLSA-200611-04 : Bugzilla: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200611-04 Bugzilla: Multiple Vulnerabilities The vulnerabilities identified in Bugzilla are as follows: Frederic Buclin and Gervase Markham discovered that input passed to various fields throughout Bugzilla were not properly...
Osprey <= 1.0 GetRecord.php Remote File Include Vulnerability
No description provided by source. --------------------------------------------------------------------------- Osprey = 1.0 libdir Remote File Include Vulnerability --------------------------------------------------------------------------- Discovered By Kw3RLn Romanian Security Team :...
phpunity.postcard (gallery_path) Remote File Include Vulnerability
Exploit for unknown platform in category web applications ================================================================== phpunity.postcard gallerypath Remote File Include Vulnerability ================================================================== phpunity.postcard phpunity-postcard.php...
CVE-2006-4468
Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow attackers to have an unknown impact via unspecified vectors involving the 1 mosMail, 2 JosIsValidEmail, and 3 josSpoofValue functions; 4 the lack of inclusion of globals.php in...
CVE-2006-4468
Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow attackers to have an unknown impact via unspecified vectors involving the 1 mosMail, 2 JosIsValidEmail, and 3 josSpoofValue functions; 4 the lack of inclusion of globals.php in...
CVE-2006-4468
CVE-2006-4468 affects Joomla! prior to 1.0.11. The vulnerability set involves multiple input- handling weaknesses (unvalidated input) across several components: mosMail, JosIsValidEmail, josSpoofValue, missing inclusion of globals.php in administrator/index.php, Admin User Manager, and the poll m...
Dragonfly CMS 9.0.6.1 and prior XSS
HeLiOsZ - Dark End Team - Internet Security Team Dragonfly CMS 9.0.6.1 and prior XSS IRC: darkend.sytes.net darkend , http://darkend.sytes.net & http://www.darkend.org Rish : Medium Type : web applet Creator: http://www.cpgnuke.com/ Exploit: - The vuln is in the search section,it don't validate t...