Copy-and-paste or drag-and-drop into designMode document allows XSS — Mozilla

Security researcher Paul Stone reported that when an HTML selection containing JavaScript is copy-and-pasted or dropped onto a document with designMode enabled the JavaScript will be executed within the context of the site where the code was dropped. A malicious site could leverage this issue in ...

SHOPEX Cross Station and CSRF vulnerabilities-vulnerability warning-the black bar safety net

Cross-site request forgerycross-site request forgeryis usually abbreviated as CSRF/XSRF, the literal translation for cross-site request forgery, i.e. an attacker by invoking third-party web site the malicious script or use the program to forge a request, of course, not need to the user end disgui...

Freelancers Marketplace Script - Persistent Cross-Site Scripting

Name : Freelancers Marketplace Script Persistent XSS Vulnerability Date : july 17,2010 Critical Level : HIGH vendor URL :http://www.guruscript.com/ google dork:Powered by Guruscript.com Author : Sid3^effects aKa HaRi special thanks to : r0073r inj3ct0r.com,L0rd...

Pligg CMS 1.0.4 Cross Site Scripting

Title: Pligg Installation File XSS Vulnerability Vendor: Pligg Product: Pligg CMS Tested Version: 1.0.4 Threat Class: XSS Severity: Medium Remote: yes Local: no Discovered By: Andrei Rimsa Alvares ===== Description ===== Pligg is prone to a XSS vulnerability in the installation file:...

Fedora 13 : viewvc-1.1.5-1.fc13 (2010-5805)

Full changelog: http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r evision=2359&view=markup&pathrev=HEAD - security fix: escape user-provided searchre input to avoid XSS attack Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Fedora 11 : viewvc-1.1.5-1.fc11 (2010-5507)

Full changelog: http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r evision=2359&view=markup&pathrev=HEAD - security fix: escape user-provided searchre input to avoid XSS attack Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Gmail Checker Plus Chrome Extension Cross Site Scripting

Gmail Checker plus Chrome extension XSS extension: https://chrome.google.com/extensions/detail/mihcahmgecmbnbcchbopgniflfhgnkff advisore:http://lostmon.blogspot.com/2010/06/gmail-checker-plus-chrome-extension-xss.html Exploit available:yes So in this case "Google Mail Checker Plus" version 1.1.7...

3Com* iMC (Intelligent Management Center) - Cross-Site Scripting / Information Disclosure Flaws

PR10-02: Various XSS and information disclosure flaws within 3Com iMC Intelligent Management Center On the 12th April 2010 Hewlett Packard completed its acquisition of 3Com Vulnerability found: 29th January 2010 Vendor informed: 1st February 2010 Vulnerability fixed: 13th May 2010 Severity:...

PHP-Nuke 7.0/8.1/8.1.35 Wormable Remote Code Execution Affecting

Exploit for php platform in category web applications ================================================================ PHP-Nuke 7.0/8.1/8.1.35 Wormable Remote Code Execution Affecting ================================================================ !/usr/bin/php ?php / Wormable Remote Code...

screenshot-redirecter.jsp XSS attach via the afterURL parameter

The screenshot-redirector.jsp does note escape the 'afterURL' URL parameter correctly, leading to an XSS attack vector...

screenshot-redirecter.jsp XSS attach via the afterURL parameter

The screenshot-redirector.jsp does note escape the 'afterURL' URL parameter correctly, leading to an XSS attack vector...

screenshot-redirecter.jsp XSS attach via the afterURL parameter

The screenshot-redirector.jsp does note escape the 'afterURL' URL parameter correctly, leading to an XSS attack vector...

runportleterror.jsp contains XSS hole

The runportleterror.jsp contains an XSS attach vector via the unescaped 'portletKey' URL parameter. The parameter should be escaped properly...

Apache Foundation Hit by Targeted XSS Attack

Combining a cross-site scripting XSS vulnerability with a TinyURL redirect, hackers successfully broke into the infrastructure for the open-source Apache Foundation in what is being described as a “direct, targeted attack.” The hackers hit the server hosting the software that Apache.org uses to i...

Discuz! Cross Site Scripting

hi; All versions of Discuz! have the cross-site vulnerabilities because of the export value of "$referer". Like: Discuz! 7.X Discuz! 6.X Discuz! 5.X Discuz!NT 3.X and so on. There are some htm pages in all versions of Discuz!, that are: /templates/default/attachpay.htm /templates/default/ecrate.h...

Uebimiau Webmail 2.7.2 - Multiple Vulnerabilities

Uebimiau Webmail 2.7.2 - Multiple Vulnerabilities Exploit Title: Uebimiau Webmail | www.DigitalWhisper.co.il Software Link: http://www.uebimiau.org/ Version: = 2.7.2 Tested on: PHP Cross Site Scripting Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are...

CVE-2010-0171

Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting XSS attacks, by using the addEventListener and setTimeo...

Torrent Hoster XSS / Shell Upload

======================================================================================== | Title : Torrent Hoster Remont Upload Exploit | Author : El-Kahina | Home : www.h4kz.com | | Script : Powered by Torrent Hoster. | Tested on: windows SP2 Français V.Pnx2 2.0 + Lunix Français v.9.4 Ubuntu | B...

Tinypug 0.9.5 - Cross-Site Request Forgery (Password Change)

Tinypug 0.9.5 - Cross-Site Request Forgery Password Change www.BugReport.ir AmnPardaz Security Research Team Title: Tinypug Multiple Vulnerabilities Vendor: http://platformassociates.com/ project hosted at http://code.google.com/p/tinypug/ Vulnerable Version: 0.9.5 and prior versions Exploitation...

Tinypug 0.9.5 - Cross-Site Request Forgery (Password Change)

www.BugReport.ir AmnPardaz Security Research Team Title: Tinypug Multiple Vulnerabilities Vendor: http://platformassociates.com/ project hosted at http://code.google.com/p/tinypug/ Vulnerable Version: 0.9.5 and prior versions Exploitation: Remote with browser Fix: N/A - Description: Tinypug is a...