Cross site scripting

Cross-site scripting XSS vulnerability in ScrewTurn Wiki 2.0.29 and 2.0.30 allows remote attackers to inject arbitrary web script or HTML via error messages in the "/admin.aspx - System Log" page...

CVE-2008-3483

Cross-site scripting XSS vulnerability in ScrewTurn Wiki 2.0.29 and 2.0.30 allows remote attackers to inject arbitrary web script or HTML via error messages in the "/admin.aspx - System Log" page...

CVE-2008-3483

CVE-2008-3483 : In ScrewTurn Wiki, vulnerable versions are 2.0.29 and 2.0.30. The issue is a cross-site scripting (XSS) vulnerability exposed via error messages on the "/admin.aspx - System Log" page, allowing remote attackers to inject arbitrary script/HTML. Root cause details are not fully disc...

CVE-2008-3483: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ScrewTurn Wiki 2.0.29 and 2.0.30 allows remote attackers to inject arbitrary web script or HTML via error messages in the "/admin.aspx - System Log" page...

ScrewTurn-Wiki_08_008.txt

Portcullis Security Advisory 08008 Vulnerable System: ScrewTurn Wiki www.screwturn.eu. Vulnerability Title: Permanent Cross-site Scripting in the "System Log" page. Vulnerability Discovery And Development: Portcullis Security Testing Services. Credit For Discovery: Ferruh Mavituna - Portcullis...

[SECURITY] Fedora 9 Update: trac-0.10.5-1.fc9

Trac is an integrated system for managing software projects, an enhanced wiki, a flexible web-based issue tracker, and an interface to the Subversion revision control system. At the core of Trac lies an integrated wiki and issue/bug database. Using wiki markup, all objects managed by Trac can...

[SECURITY] Fedora 8 Update: trac-0.10.5-1.fc8

Trac is an integrated system for managing software projects, an enhanced wiki, a flexible web-based issue tracker, and an interface to the Subversion revision control system. At the core of Trac lies an integrated wiki and issue/bug database. Using wiki markup, all objects managed by Trac can...

Trac Wiki引擎跨站脚本执行漏洞

BUGTRAQ ID: 30400 CVECAN ID: CVE-2008-3328 Trac是用Python编写的基于Web的事件跟踪系统。 Trac的Wiki引擎没有正确地验证某些参数便返回给了用户，远程攻击者可以通过向服务器提交恶意请求执行脚本注入或跨站脚本攻击。 Edgewall Software Trac 0.10.5 Edgewall Software ----------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://ftp.edgewall.com/pub/trac/trac-0.10.5.tar.gz...

DEBIAN-CVE-2008-3328

Cross-site scripting XSS vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

PYSEC-2008-5

Cross-site scripting XSS vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2008-3328

Cross-site scripting XSS vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

PYSEC-2008-5

Cross-site scripting XSS vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2008-3328

CVE-2008-3328 : Trac’s wiki engine before 0.10.5 has a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script via unknown vectors. Connected advisories confirm the issue is shell-agnostic to input points in the wiki engine prior to 0.10.5. The available r...

CVE-2008-3328

Cross-site scripting XSS vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2008-3328: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CGI::Session CGISESSID Cookie值目录遍历漏洞

BUGTRAQ ID: 30267 CGI::Session是一个Perl5库，可提供可靠易用的模块化会话管理系统。 CGI::Session没有充分的过滤CGISESSID cookie值便将其用在了File驱动中创建会话数据文件的文件名。如果远程攻击者在cookie值中注入了目录遍历序列，就会导致File驱动从配置的会话数据目录以外的任意文件读取会话数据。 仅在满足了所有以下条件的情况下才可以利用这个漏洞： 1 Web应用使用了CGI::Session中的File驱动管理会话。 2 Web应用部署于基于Windows的系统。 3...

Directory traversal

Directory traversal vulnerability in index.php in Easy-Script Wysi Wiki Wyg 1.0 allows remote attackers to read arbitrary files via a .. dot dot in the c parameter...

CVE-2008-3205

Directory traversal vulnerability in index.php in Easy-Script Wysi Wiki Wyg 1.0 allows remote attackers to read arbitrary files via a .. dot dot in the c parameter...

CVE-2008-3205

Directory traversal vulnerability in index.php in Easy-Script Wysi Wiki Wyg 1.0 allows remote attackers to read arbitrary files via a .. dot dot in the c parameter...

CVE-2008-3205

CVE-2008-3205 is a directory traversal vulnerability in the Easy-Script Wysi Wiki Wyg 1.0 web app, exploitable via a dot-dot sequence in the c parameter of index.php to read arbitrary files. The NVD entry gives a CVSSv2 base score of 5.0 (Medium) with network access, low attack complexity, no aut...