231 matches found
dalbum 144 build 174 and earlier CSRF Vulnerabilities
No description provided by source. dalbum 144 build 174 and earlier CSRF Vulnerabilities =================================================================================== Exploit Title:dalbum 144174 and earlier CSRF Vulnerabilities Vendor: http://www.dalbum.org/ Download link...
Microsoft Internet Explorer 5/6 JavaScript Interface Spoofing Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3469/info It is reported that Microsoft Internet Explorer may permit aspects of the Internet Explorer interface to be spoofed. This could facilitate numerous attacks against users of the browser, including spoofing of bot...
Tencent microblogging XSS attack vulnerability-vulnerability warning-the black bar safety net
from: author:Kingthy's I believe we all know Sina Weibo in 6 on 2 8 may occurXSSattack event? That night, a large number of Sina Weibo users to automatically send tweets and automatically focus on one called“hellosamy“of the user. What exactlyXSSattacks why can have so much power for? Now many...
CVE-2008-7100
Unspecified vulnerability in DotNetNuke 4.4.1 through 4.8.4 allows remote authenticated users to bypass authentication and gain privileges via unknown vectors related to a "unique id" for user actions and improper validation of a "user identity."...
Web Server Uses Non Random Session IDs
The remote web server generates a session ID for each connection. A session ID is typically used to keep track of a user's actions while they visit a website. The remote server generates non-random session IDs. An attacker might use this flaw to guess the session IDs of other users and therefore...
Native DOM methods can be hijacked across domains — Mozilla
A malicious page can hijack native DOM methods on a document object in another domain, which will run the attacker's script when called by the victim page. This could be used to steal login cookies, password, or other sensitive data on the target page, or to perform actions on behalf of a logged-...
CVE-2005-0677
index.php for Zorum 3.5 allows remote attackers to perform certain actions as other users by modifying the id parameter...
Privilege escalation via DOM property overrides — Mozilla
mozbugra4 reported several exploits giving an attacker the ability to install malicious code or steal data, requiring only that the user do commonplace actions like click on a link or open the context menu. The common cause in each case was privileged UI code "chrome" being overly trusting of DOM...
Link opened in new tab can load a local file — Mozilla
Links with a custom getter and toString method can bypass checks intended to prevent web content from linking to local files and "chrome" URIs if the user can be convinced to middle-click or control-click to open it in a new tab. The browser's "same-origin" policy prevents the attacker's content...
Nihuo Web Log Analyzer 1.6 - HTML Injection
Nihuo Web Log Analyzer 1.6 - HTML Injection source: https://www.securityfocus.com/bid/10988/info An HTML injection vulnerability is reported in Nihuo Web Log Analyzer. The problem occurs due to a lack of proper sanitization of user-supplied input data. Attackers may potentially exploit this issue...
