SA-2008-001 - Devel - Cross site scripting

The devel module contains many useful developer functions, such as a query log and the display of variables. The contents of the variable table is not escaped prior to display. Should an unprivileged user be able to control the contents of a site variable, it would be possible to inject arbitrary...

Microsoft DebugView Dbgv.sys内核模块本地权限升漏洞

BUGTRAQ ID: 26359 CVECAN ID: CVE-2007-4223 DebugView允许用户监控本地系统或可通过TCP/IP访问的网络中计算机上的调试输出。 DebugView所加载的Dbgv.sys内核模块中的功能可能允许将用户提供的数据拷贝到内核中可控的地址，这样恶意用户就可以向运行的内核中注入任意代码。 如果要利用这个漏洞，管理员必须加载DebugView，这样才会将Dbgv.sys驱动加载到内核，然后所有用户在系统重启之前都可以访问有漏洞的内核模块。 Microsoft DebugView 4.64...

SA-2007-027 - Token - Cross site scripting

Several server variables are not escaped consistently. When a malicious user is able to enter comments and then entice a victim to visit a webpage, arbitrary HTML and script code can be injected and executed in the context of the victim's session on the targeted website. For example, a malicious...

Shop-Script FREE <= 2.0 Remote Command Execution Exploit

Exploit for unknown platform in category web applications ======================================================== Shop-Script FREE = 2.0 Remote Command Execution Exploit ======================================================== ?php Shop-Script FREE = 2.0 Remote Command Execution Exploit by InATe...

CVE-2007-4077

Multiple cross-site scripting XSS vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to inject arbitrary web script or HTML via the 1 msg, 2 page, 3 viewkey, or 4 viewtype parameter to a viewvideo.php; the 5 next parameter to b signup.php; the 6 searchid parameter to c...

Another You tube clone script vulnerability

ChX Security | Advisory 2 | ============= - "Generic YouTube Clone Script - XSRF: Arbitrary Code Injection" - Data | ====== Author: Pepepistola Pepepistolaatchxsecuritydotorg Program: Generic YouTube Clone Script Severity: Moderately Critical Type of Advisory: Mid Disclosure Affected/Tested...

CVE-2007-0529

Cross-site scripting XSS vulnerability in index.html aka the administration page in PHP Link Directory phpLD 3.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted link, which is triggered when the administrator uses the "Validate Links" functionality...

CVE-2006-5770

Multiple cross-site scripting XSS vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via 1 Bloks, 2 Newnews, 3 lBlok, and 4 foooot parameter in a index.php; Newnews, 5 newmsgs, and Bloks parameter in b MobileNews.php; Newnews parameter in c polls.php; 6...

mono -- "System.CodeDom.Compiler" Insecure Temporary Creation

Sebastian Krahmer reports: Sebastian Krahmer of the SuSE security team discovered that the System.CodeDom.Compiler classes used temporary files in an insecure way. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program...

DokuWiki doku.php X-FORWARDED-FOR HTTP Header Arbitrary Code Injection

The remote host is running DokuWiki, an open source wiki application written in PHP. The installed version of DokuWiki includes a script, 'bin/dwpage.php', that is intended as a command line tool for modifying pages. By accessing it through the web, an unauthenticated, remote attacker can abuse i...

cpanel10xss.txt

C P A N E L 1 0 Preth00nker at gmail dot com BY PRETH00NKER http://mexhackteam.org special dedication for my friends of: introduction Preth00nker was discovering some news vulnerabilities in cpanel 10. Cite: cPanel allows domain owners to manage and monitor their web site. This easy to use...

CVE-2006-3061

Multiple cross-site scripting XSS vulnerabilities in 5 Star Review allow remote attackers to inject arbitrary web script or HTML via the 1 sort parameter in index2.php, 2 itemid parameter in report.php, 3 searchterm parameter aka the "search box" in searchreviews.php, 4 the profile field in...

WordPress < 2.0.3 Arbitrary Code Injection

Binary data 3647.prm...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PHP ManualMaker 1.0 allows remote attackers to inject arbitrary web script or HTML via the 1 id parameter to index.php, 2 search field possibly the s parameter, or 3 comment field...

JupiterCMS.txt

Jupiter CMS , to redirect the user to a page of your choice, to avoid suspicion and disclosure of your cookiestealer's location. This injections would allow an attacker to redirect users to a page of his choice, effectively defacing the page:...

NOCC 1.0 - html_bottom_table.php Multiple Cross-Site Scripting Vulnerabilities

NOCC 1.0 - htmlbottomtable.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/16793/info NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An...

123 Flash Chat 5.0 - Remote Code Injection

source: https://www.securityfocus.com/bid/16360/info 123 Flash Chat is prone to an arbitrary code injection weakness. An attacker can influence the value of a variable that is insecurely passed to an 'eval' call. Successful exploitation may allow attackers to take complete control of the...

MSIEDoS.txt

Advisory Name MicrosoftR Internet Explorer 5 & 6 Remote Denial of Service DoS using IMG & XML elements Release Date 14. January 2006 Vulnerable Product MicrosoftR Internet Explorer 5 MicrosoftR Internet Explorer 6 Tested and Confirmed Vulerable Microsoft® Windows® XP Professional with Service Pac...

[SECURITY] [DSA 811-2] New common-lisp-controller packages fix arbitrary code injection

-------------------------------------------------------------------------- Debian Security Advisory DSA 811-2 [email protected] http://www.debian.org/security/ Martin Schulze November 21st, 2005 http://www.debian.org/security/faq -...

YaPiG Remote Server-Side Script Execution Vulnerability

The remote web server contains a PHP application that is prone to arbitrary PHP code injection vulnerabilities. Description : The remote host is running YaPiG, a web-based image gallery written in PHP. The remote version of YaPiG may allow a remote attacker to execute malicious scripts on a...