CVE-2014-2966

CVE-2014-2966 affects Resin Pro before 4.0.40. The ISO-8859-1 encoder does not perform Unicode transformations correctly, allowing crafted characters to bypass restrictions and the XSS protection mechanism in HTTP responses. The primary affected component is Resin Pro’s ISO-8859-1 output handling...

MyBB Profile Blogs Plugin 1.2 - Multiple Vulnerabilities

No description provided by source. Exploit Title: MyBB Profile Blog plugin multiple vulnerabilities. Google Dork: inurl:member.php intext:Profile Blogs for MyBB Date: 12.9.2012 Exploit Author: Zixem Vendor Homepage: http://fklar.pl/ Software Link: http://mods.mybb.com/view/profile-blogs Version:...

t-dah webmail client 3.2.0-2.3 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: T-dah Webmail Client Version: 3.2.0-2.3 Vendor Site: http://t-dahmail.sourceforge.net/index.php Software Download: http://sourceforge.net/projects/t-dahmail/ Contact:...

IRCCloud: Reflected XSS in Pastebin-view

The paste ID passed in via the URL in the Pastebin-view is inserted between tags unsanitised. This leads to reflected XSS that bypasses all major XSS protection software Chrome, IE.... Normal request: https://www.irccloud.com/pastebin/nhm4f6pB Proof-of-concept:...

ReddAPI: Browser cross-site scripting filter misconfiguration

Issue detail :- No X-XSS-Protection header was set in the response. This means that the browser uses default behaviour that detection of a cross-site scripting attack never prevents rendering. Remediation detail The following header should be set: X-XSS-Protection: 1; mode=block Issue background ...

Contao CMS 3.2.4 Code Execution Vulnerability

Contao CMS versions 3.2.4 and below suffer from a code execution vulnerability. Hi, I have discovered a vulnerability that might lead to code execution in Contao CMS Vulnerabilities in Contao 3.2.4 Discovered by Pedro Ribeiro email protected of Agile Information Security...

Convert the SecurityHeadersInterceptor into a filter that applies to /*

The X-XSS-Protection HTTP header should be sent on all responses with a value of "1; mode=block". As the current implementation is done in an interceptor0 it is possible for some resources to be sent without the X-XSS-Protection header. 0 SecurityHeadersInterceptor is in the default interceptor...

Convert the SecurityHeadersInterceptor into a filter that applies to /*

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-30356. panel The X-XSS-Protection HTTP header should be sent on all responses with a value of "1; mode=block". As the current...

Convert the SecurityHeadersInterceptor into a filter that applies to /*

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-30356. panel The X-XSS-Protection HTTP header should be sent on all responses with a value of "1; mode=block". As the current...

WordPress FuneralPress 1.1.6 Cross Site Scripting

WP FuneralPress - stored xss in guestbook "FuneralPress is an online website obituary management and guest book program for funeral homes and cemeteries" http://wpfuneralpress.com/ tested on: funeralpress version 1.1.6 / wordpress version 3.5.1 impact: malicious script execution as wordpress...

MyBB Profile Blogs 1.2 Cross Site Scripting / SQL Injection

Exploit Title: MyBB Profile Blog plugin multiple vulnerabilities. Google Dork: inurl:member.php intext:"Profile Blogs" for MyBB Date: 12.9.2012 Exploit Author: Zixem Vendor Homepage: http://fklar.pl/ Software Link: http://mods.mybb.com/view/profile-blogs Version: 1.2+ Tested on: Linux. MyBB Profi...

MyBB Profile Blogs Plugin 1.2 - Multiple Vulnerabilities

Exploit Title: MyBB Profile Blog plugin multiple vulnerabilities. Google Dork: inurl:member.php intext:"Profile Blogs" for MyBB Date: 12.9.2012 Exploit Author: Zixem Vendor Homepage: http://fklar.pl/ Software Link: http://mods.mybb.com/view/profile-blogs Version: 1.2+ Tested on: Linux. MyBB Profi...

Internet Explorer 9.10 - XSS Protection Filter Vulnerabilities

Document Title: =============== Internet Explorer 9.10 - XSS Protection Filter Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=729 Release Date: ============= 2012-10-20 Vulnerability Laboratory ID VL-ID:...

Internet Explorer 9.10 - XSS Protection Filter Vulnerabilities

Document Title: =============== Internet Explorer 9.10 - XSS Protection Filter Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=729 Release Date: ============= 2012-10-19 Vulnerability Laboratory ID VL-ID:...

Cross site scripting

The t3libdiv::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting XSS protection mechanism and inject arbitrary web script or HTML via non printable characters...

CVE-2012-1608

TYPO3 CVE-2012-1608 affects the t3lib_div::RemoveXSS API. Vulnerable in TYPO3 versions 4.4.0–4.4.13, 4.5.0–4.5.13, 4.6.0–4.6.6, 4.7, and 6.0. The issue allows remote attackers to bypass the XSS protection and inject arbitrary web script or HTML via non-printable characters. Connected documents co...

CVE-2012-1965

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting XSS protection mechanisms via a feed:javascript: URL...

Cross site scripting

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting XSS protection mechanisms via a feed:javascript: URL...

PT-2012-3695

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 13.0 Mozilla Firefox ESR versions 10.x before 10.0.6 Description The issue allows remote attackers to bypass cross-site scripting XSS protection mechanisms. This is achieved via a feed:javascript: URL, whic...

Postfixadmin 2.3.4 SQL Injection / Cross Site Scripting

Advisory ID: CSA-12002 Title: Multiple vulnerabilities in postfixadmin Product: postfixadmin Version: 2.3.4 and probably prior Vendor: www.postifixadmin.org Vulnerability type: SQL injection, XSS Vendor notification: 2012-01-10 Public disclosure: 2012-01-26 postfixadmin version 2.3.4 and probably...