[Full-disclosure] HYSA-2006-006 G-Book 1.0 XSS And Other Vulnerabilities

------------------------------------------------------ HYSA-2006-006 h4cky0u.org Advisory 015 ------------------------------------------------------ Date - Mon March 27 2006 TITLE: ====== G-Book 1.0 XSS, Possible authentication bypass & mass message flood SEVERITY: ========= High SOFTWARE:...

Design/Logic Flaw

Mozilla Thunderbird 1.5 allows user-assisted attackers to cause an unspecified denial of service by tricking the user into importing an LDIF file with a long field into the address book, as demonstrated by a long homePhone field...

CVE-2006-0836: Undefined Security Weakness

Mozilla Thunderbird 1.5 allows user-assisted attackers to cause an unspecified denial of service by tricking the user into importing an LDIF file with a long field into the address book, as demonstrated by a long homePhone field...

[Full-disclosure] Mozila Thunderbird 1.5 Address Book DoS

Affected: Mozila Thunderbird 1.5 /possibly other versions/ Mozila Thunderbird 1.5 address book allows fields of unlimited size in the address book which leads to a DoS if you import such ldif file POC: create a file.ldif and insert following then import it in address book: n: cn=Test POC by...

Mozilla Thunderbird 1.5 - Address Book Import Remote Denial of Service

Mozilla Thunderbird 1.5 - Address Book Import Remote Denial of Service source: https://www.securityfocus.com/bid/16716/info Mozilla Thunderbird is prone to a remote denial-of-service vulnerability. The issue presents itself when the application handles a specially crafted address book file. Mozil...

Mozilla Thunderbird 1.5 - Address Book Import Remote Denial of Service

source: https://www.securityfocus.com/bid/16716/info Mozilla Thunderbird is prone to a remote denial-of-service vulnerability. The issue presents itself when the application handles a specially crafted address book file. Mozilla Thunderbird 1.5 is reportedly affected by this issue. Other versions...

Mercury Mail Transport System Phonebook service buffer overflow

Added: 02/02/2006 CVE: CVE-2005-4411 BID: 16396 OSVDB: 22103 Background Mercury Mail Transport System is a free mail server for Windows and Netware platforms. It includes a Phone Book service which runs on port 105/TCP. Problem A buffer overflow vulnerability in the Phone Book service allows remo...

html in simpbook

Advisory 1 Title: HTML Injection Vulnerability in Simpbook all vercion Author: 0ozeuso0 Contact: [email protected] Website: olimpusklan.org Date: 23/12/2005 Risk: High Vendor Url: http://www.codegrrl.com Affected Software: Simpbook Non Affected: We Are:olimpus klan team...

CVE-2005-4242

Multiple cross-site scripting XSS vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the address book and 2 contact data...

CVE-2005-4242

Multiple cross-site scripting XSS vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the address book and 2 contact data...

CVE-2005-4242: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the address book and 2 contact data...

CVE-2005-4190

Multiple cross-site scripting XSS vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by 1 the identity field, 2 Category and 3 Label search fields, 4 the Mobile Phone field, and ...

CVE-2005-4190: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by 1 the identity field, 2 Category and 3 Label search fields, 4 the Mobile Phone field, and ...

CVE-2005-4177

Cross-site scripting XSS vulnerability in book.cfm in Magic Book Personal and Professional 2.0 allows remote attackers to inject arbitrary web script or HTML via the StartRow parameter...

CVE-2005-4177

Cross-site scripting XSS vulnerability in book.cfm in Magic Book Personal and Professional 2.0 allows remote attackers to inject arbitrary web script or HTML via the StartRow parameter...

CVE-2005-4177

The CVE-2005-4177 entry concerns an XSS vulnerability in Magic Book Personal and Professional 2.0, specifically in the book.cfm component where the StartRow parameter is not properly sanitized. The vulnerability could allow remote attackers to inject arbitrary web script or HTML, as documented by...

CVE-2005-4177: Undefined Security Weakness

Cross-site scripting XSS vulnerability in book.cfm in Magic Book Personal and Professional 2.0 allows remote attackers to inject arbitrary web script or HTML via the StartRow parameter...

Magic Book Professional 2.0 - 'Book.cfm' Cross-Site Scripting

source: https://www.securityfocus.com/bid/15805/info Magic Book Professional is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in...

Magic List Pro - view_archive.cfm?ListID SQL Injection

Magic List Pro - viewarchive.cfm?ListID SQL Injection source: https://www.securityfocus.com/bid/15774/info CFMagic Products are prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input. These vulnerabilities allow an attacker to...

Magic Forum Personal - 'view_thread.cfm' Multiple SQL Injections

source: https://www.securityfocus.com/bid/15774/info CFMagic Products are prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input. These vulnerabilities allow an attacker to inject malicious SQL code into database queries, and...