263 matches found
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via 1 the community title, 2 API input, and vectors related to the 3 Homepage, 4 Blogs, 5 Profiles, 6 Dogear, 7 Activities, and 8 Global Search...
Cross site scripting
Cross-site scripting XSS vulnerability in Bitweaver 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to 1 edit.php and 2 list.php in articles/; 3 listblogs.php and 4 rankings.php in blogs/; 5 calendar/index.php; 6 calendar.php, 7 index.php, and 8...
CVE-2008-3735
Cross-site scripting XSS vulnerability in index.php in PHPizabi before 848 Core HotFix Pack 3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a blogs.search action...
CVE-2008-3735
Cross-site scripting XSS vulnerability in index.php in PHPizabi before 848 Core HotFix Pack 3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a blogs.search action...
CVE-2007-6597
Multiple cross-site scripting XSS vulnerabilities in IPortalX before Build 033 allow remote attackers to inject arbitrary web script or HTML via the 1 KW and 2 SF parameters to forum/loginuser.asp, and 3 the Date parameter to blogs.asp...
PT-2007-7428 · Iportalx · Iportalx
Name of the Vulnerable Software and Affected Versions: IPortalX versions prior to Build 033 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected API endpoints include...
Unfixed XSS vulnerability at scienceblogs.com
Security researcher tenest, has submitted on 12/11/2007 a cross-site-scripting XSS vulnerability affecting scienceblogs.com, which at the time of submission ranked 11754 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/11/2007. It is currentl...
openSUSE 10 Security Update : moodle (moodle-3959)
This update fixes the following issues : - possible remote file inclusion CVE-2007-1429 - XSS injection in SCORM 1.2 reports - Fixed XSS in login block Additionally changes : - Fixed visibility of site blogs - moodle-config.php is now located in /etc/moodle/ - added safemode and session.savehandl...
Wordpress Multiple Versions Pwnpress Exploitation Tookit (0.2pub)
Exploit for unknown platform in category web applications ================================================================= Wordpress Multiple Versions Pwnpress Exploitation Tookit 0.2pub ================================================================= !/usr/bin/env ruby .---. .---. : : o : happ...
PHPBlogger cookie privilege escalation
PHPBlogger is a simple tool to help the creation of web blogs... Encrypted admin password and other preferences are stored on /data/pref.db You can find lots of them exposed with google search: pref password= filetype:db = -------------------------------------------- The admin panel is acessible...
PHPBlogger is a simple tool to help the creation of web blogs... Encrypted admin password and other preferences are stored on /data/pref.db You can find lots of them exposed with google search: pref password= filetype:db = -------------------------------------------- The admin panel is acessible...
Authentication flaw
geoBlog aka BitDamaged 1 does not require authentication for 1 deletecomment.php, 2 deleteblog.php, and 3 listcomment.php in admin/, which allows remote attackers to delete arbitrary comments, delete arbitrary blogs, and have other unspecified impact via a request with a valid id parameter...
CVE-2007-4047
geoBlog aka BitDamaged 1 does not require authentication for 1 deletecomment.php, 2 deleteblog.php, and 3 listcomment.php in admin/, which allows remote attackers to delete arbitrary comments, delete arbitrary blogs, and have other unspecified impact via a request with a valid id parameter...
blogsite-sql.txt
--==+================================================================================+==-- --==+ BlogSite Professional SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE: N/A DORK:...
GeoBlog MOD_1.0 - deletecomment.php?id Arbitrary Comment Deletion
GeoBlog MOD1.0 - deletecomment.php?id Arbitrary Comment Deletion source: https://www.securityfocus.com/bid/24966/info geoBlog is prone to multiple security-bypass vulnerabilities because the application fails to properly validate users when deleting user blogs and comments. An attacker may exploi...
GeoBlog MOD_1.0 - 'deleteblog.php?id' Arbitrary Blog Deletion
source: https://www.securityfocus.com/bid/24966/info geoBlog is prone to multiple security-bypass vulnerabilities because the application fails to properly validate users when deleting user blogs and comments. An attacker may exploit these issues to delete blogs and comments regardless of the...
Geoblog v1 administrator bypass
Geoblog v1. A vulnerability exists in geoblog version 1 latest that allows users to delete other peoples comments without administration credentials. It works on blogs too. Users can delete blogs without user credentials. The reason why is because the listcomments.php and deletecomments.php files...
Apple Safari 2.0.4 - Cross-Domain Browser Location Information Disclosure
source: https://www.securityfocus.com/bid/24121/info Apple Safari is prone to an information-disclosure vulnerability because it fails to properly enforce cross-domain JavaScript restrictions. Exploiting this issue may allow attackers to access locations that a user visits, even if it's in a...
CVE-2007-2681
Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the coresubdir parameter...
CVE-2006-6925
Multiple cross-site scripting XSS vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the message title field when submitting an article to articles/edit.php, 2 the message title field when submitting a blog post to blogs/post.php, or...