Design/Logic Flaw

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 disables the http.device.stanza blacklisting functionality for HTTP Access Services HTTP-AS, which allows remote attackers to bypass intended access restrictions via an HTTP request that contains a disallowed User-Agent header...

CVE-2010-4595: Undefined Security Weakness

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 disables the http.device.stanza blacklisting functionality for HTTP Access Services HTTP-AS, which allows remote attackers to bypass intended access restrictions via an HTTP request that contains a disallowed User-Agent header...

CVE-2010-4147

Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to 1 index.php and 2 product-list.php...

Sql injection

Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to 1 index.php and 2 product-list.php...

CVE-2010-4147

Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to 1 index.php and 2 product-list.php...

CVE-2010-4147: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to 1 index.php and 2 product-list.php...

CVE-2003-1587

Cross-site scripting XSS vulnerability in LoganPro allows remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header...

CVE-2008-7250

Cross-site scripting XSS vulnerability in Squid Analysis Report Generator Sarg 2.2.4 allows remote attackers to inject arbitrary web script or HTML via a JavaScript onload event in the User-Agent header, which is not properly handled when displaying the Squid proxy log. NOTE: this issue exists...

DEBIAN-CVE-2008-7250

Cross-site scripting XSS vulnerability in Squid Analysis Report Generator Sarg 2.2.4 allows remote attackers to inject arbitrary web script or HTML via a JavaScript onload event in the User-Agent header, which is not properly handled when displaying the Squid proxy log. NOTE: this issue exists...

CVE-2008-7250

Cross-site scripting XSS vulnerability in Squid Analysis Report Generator Sarg 2.2.4 allows remote attackers to inject arbitrary web script or HTML via a JavaScript onload event in the User-Agent header, which is not properly handled when displaying the Squid proxy log. NOTE: this issue exists...

CVE-2008-7250: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Squid Analysis Report Generator Sarg 2.2.4 allows remote attackers to inject arbitrary web script or HTML via a JavaScript onload event in the User-Agent header, which is not properly handled when displaying the Squid proxy log. NOTE: this issue exists...

Cross site scripting

Cross-site scripting XSS vulnerability in the "Monitor browsers' feature in Browscap before 5.x-1.1 and 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

CVE-2009-3651

Cross-site scripting XSS vulnerability in the "Monitor browsers' feature in Browscap before 5.x-1.1 and 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

CVE-2009-3652

The CVE-2009-3652 entry covers a Cross-site scripting (XSS) vulnerability in Drupal's Organic Groups (OG) module. It affects OG 5.x-7.x before 5.x-7.4, OG 5.x-8.x before 5.x-8.1, and OG 6.x-1.x before 6.x-1.4. The issue allows remote authenticated users (with create or edit group nodes permission...

Mandriva Update for sarg MDVSA-2008:079 (sarg)

Check for the Version of sarg OpenVAS Vulnerability Test Mandriva Update for sarg MDVSA-2008:079 sarg Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

CVE-2008-6645

Cross-site scripting XSS vulnerability in Opencosmo VisualSentinel 0.7 allows remote attackers to inject arbitrary web script or HTML via the User-Agent header $SERVER 'HTTPUSERAGENT', which is not properly handled when displaying log files...

CVE-2008-6645: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Opencosmo VisualSentinel 0.7 allows remote attackers to inject arbitrary web script or HTML via the User-Agent header $SERVER 'HTTPUSERAGENT', which is not properly handled when displaying log files...

Stable and Beta Update: Incognito Mode Fix

Google Chrome's Beta and Stable channels have been updated to 1.0.154.48. The change in 1.0.154.46 to fix Hotmail caused a problem for users in Incognito mode trying to access sites which depend on the User-Agent header. This header identifies the type of browser making the request and should be...

MercuryBoard 1.1.5 - login.php Blind SQL Injection

MercuryBoard 1.1.5 - login.php Blind SQL Injection settitle$this-lang-loginheader; 55. $this-tree$this-lang-loginheader; 56. 57. //print "agent: $this-agent\n"; 58. 59. if !isset$this-post'submit' 60. $requesturi = $this-geturi; 61. 62. if substr$requesturi, -8 == 'register' 63. $requesturi =...

MercuryBoard 1.1.5 - 'login.php' Blind SQL Injection

settitle$this-lang-loginheader; 55. $this-tree$this-lang-loginheader; 56. 57. //print "agent: $this-agent\n"; 58. 59. if !isset$this-post'submit' 60. $requesturi = $this-geturi; 61. 62. if substr$requesturi, -8 == 'register' 63. $requesturi = $this-self; 64. 65. 66. return...