RedLevel Advisory #021 - CubeCart v3.0.16 SQL Injection Vulnerability

An interesting SQL injection vulnerability was discovered in CubeCart v3.0.16. This vulnerability cannot easily be exploited by traditional means - in fact, the actual vulnerable variable was not discovered. As a piece of user input is passed to CubeCart, it is sanitized through a routine mySQLSa...

Unfixed XSS vulnerability at www.worldshakesbib.org

Security researcher MaXWeL, has submitted on 24/05/2007 a cross-site-scripting XSS vulnerability affecting www.worldshakesbib.org, which at the time of submission ranked 1986481 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/05/2007. It is...

cisco-input.txt

Cisco CallManager 4.1 Input Validation Vulnerability scip AG Vulnerability ID 2977 03/13/2007 http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2977 I. INTRODUCTION Cisco CallManager, short CCM, is a professional voice-over-IP solution that tracks active components, including among others phones,...

Unfixed XSS vulnerability at c-library.um.ac.ir

Security researcher Hotpockets, has submitted on 23/05/2007 a cross-site-scripting XSS vulnerability affecting c-library.um.ac.ir, which at the time of submission ranked 29535 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/05/2007. It is...

tomcat accept-language xss flaw

Cross-site scripting XSS vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616"...

DEBIAN-CVE-2007-2739

Cross-site scripting XSS vulnerability in xajax before 0.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Unfixed XSS vulnerability at www.toolband.com

Security researcher sshjason, has submitted on 13/05/2007 a cross-site-scripting XSS vulnerability affecting www.toolband.com, which at the time of submission ranked 54625 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/05/2007. It is...

Unfixed XSS vulnerability at www.bol.ba

Security researcher Uber0n, has submitted on 05/12/2007 a cross-site-scripting XSS vulnerability affecting www.bol.ba, which at the time of submission ranked 2096815 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/12/2007. It is currently...

Unfixed XSS vulnerability at www.faith-go.co.jp

Security researcher kusomiso.com, has submitted on 05/09/2007 a cross-site-scripting XSS vulnerability affecting www.faith-go.co.jp, which at the time of submission ranked 50795 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/09/2007. It is...

php CRLF injection

CRLF injection vulnerability in the ftpputcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands...

Unfixed XSS vulnerability at www.ltc-la.org

Security researcher frosTMaturidi, has submitted on 05/07/2007 a cross-site-scripting XSS vulnerability affecting www.ltc-la.org, which at the time of submission ranked 2603932 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/07/2007. It is...

Unfixed XSS vulnerability at www.sairistan.com

Security researcher cyber, has submitted on 16/04/2007 a cross-site-scripting XSS vulnerability affecting www.sairistan.com, which at the time of submission ranked 2863453 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/04/2007. It is...

CVE-2007-1968

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the scoreid parameter...

Unfixed XSS vulnerability at www.kruechtener-getraenkemarkt.de

Security researcher BackDoor, has submitted on 04/11/2007 a cross-site-scripting XSS vulnerability affecting www.kruechtener-getraenkemarkt.de, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/11/2007...

Unfixed XSS vulnerability at makimo.to

Security researcher kusomiso.com, has submitted on 04/09/2007 a cross-site-scripting XSS vulnerability affecting makimo.to, which at the time of submission ranked 106112 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/09/2007. It is currentl...

Unfixed XSS vulnerability at arnaldorodriguez.com

Security researcher cr0xip, has submitted on 04/08/2007 a cross-site-scripting XSS vulnerability affecting arnaldorodriguez.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/08/2007. It is currentl...

Unfixed XSS vulnerability at pics.vivekmittal.org

Security researcher KaBuS, has submitted on 04/03/2007 a cross-site-scripting XSS vulnerability affecting pics.vivekmittal.org, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/03/2007. It is currently...

Unfixed XSS vulnerability at www.baxana.com

Security researcher cyber, has submitted on 30/03/2007 a cross-site-scripting XSS vulnerability affecting www.baxana.com, which at the time of submission ranked 818326 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 31/03/2007. It is currently...

Unfixed XSS vulnerability at www.merianstiftung.ch

Security researcher MaXWeL, has submitted on 23/03/2007 a cross-site-scripting XSS vulnerability affecting www.merianstiftung.ch, which at the time of submission ranked 5295578 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/03/2007. It is...

Unfixed XSS vulnerability at www.1company.cz

Security researcher Cyber-Unity, has submitted on 21/03/2007 a cross-site-scripting XSS vulnerability affecting www.1company.cz, which at the time of submission ranked 4538320 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/03/2007. It is...