Sniggabo CMS 2.21 - search.php Cross-Site Scripting

Sniggabo CMS 2.21 - search.php Cross-Site Scripting source: https://www.securityfocus.com/bid/40534/info Sniggabo CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in...

lxr -- multiple XSS vulnerabilities

Dan Rosenberg reports: There are several cross-site scripting vulnerabilities in LXR. These vulnerabilities could allow an attacker to execute scripts in a user's browser, steal cookies associated with vulnerable domains, redirect the user to malicious websites, etc...

SAP NetWeaver performanceProvierRoot - XSS

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs: Information disclose Exploits: YES Reported: 01.04.2010 Vendor response: 08.04.2010 Date of Public Advisory: 17.06.2011 CVSS: 5.0 Author:Dmitriy Chastuhin Description SAP NetWeaver...

Google Chrome 4.0.249.30 DoS PoC

Exploit for unknown platform in category dos / poc ================================ Google Chrome 4.0.249.30 DoS PoC ================================ Title: Google Chrome 4.0.249.30 DoS PoC CVE-ID: OSVDB-ID: Published: 2010-01-03 Verified: yes view source print? !/usr/bin/perl google chrome...

VirtuaSystems VirtuaNews Pro 1.0.4 - admin.php Cross-Site Scripting

VirtuaSystems VirtuaNews Pro 1.0.4 - admin.php Cross-Site Scripting source: https://www.securityfocus.com/bid/37568/info VirtuaNews Pro is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to...

Joomla! Component MS Comment 0.8.0b - Security Bypass Cross-Site Scripting

Joomla! Component MS Comment 0.8.0b - Security Bypass Cross-Site Scripting source: https://www.securityfocus.com/bid/38250/info The MS Comment component for Joomla! is prone to a security-bypass vulnerability because it fails to properly sanitize user-supplied input. The component is also prone t...

LiveZilla 3.1.8.3 - Multiple Cross-Site Scripting Vulnerabilities

LiveZilla 3.1.8.3 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/41271/info LiveZilla is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

LiveZilla 3.1.8.3 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/41271/info LiveZilla is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Browser Attacks Continue to Evolve

While the security teams at Microsoft, Mozilla and the other browser vendors continue to work on new defenses and exploit mitigations, the state of the art in attacks is continuing to evolve. Security researcher Robert Hansen recently pointed out a new technique that could be used for a twist on...

cPanel 11.x - fileop Multiple Cross-Site Scripting Vulnerabilities

cPanel 11.x - fileop Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/37394/info cPanel is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input An attacker may leverage these issues...

APC Network Management Card - Cross-Site Request Forgery / Cross-Site Scripting

source: https://www.securityfocus.com/bid/37338/info The APC Network Management Card is prone to multiple cross-site request-forgery and cross-site scripting vulnerabilities. An attacker can exploit the cross-site request forgery issues to alter the settings on affected devices, which may lead to...

WS Interactive Automne 4.0 - 228-recherche.php Cross-Site Scripting

WS Interactive Automne 4.0 - 228-recherche.php Cross-Site Scripting source: https://www.securityfocus.com/bid/41686/info Automne is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...

Microsoft Internet Explorer CSS Race Condition Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the computer. Failed attacks m...

Microsoft Internet Explorer 'CAttrArray' Object Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the computer. Failed attacks m...

Robert Hansen on DNS Rebinding Attacks and Browser Security

Dennis Fisher talks with security researcher Robert “Rsnake” Hansen about his recent work on DNS rebinding attacks, the poor state of browser security and his new book “Detecting Malice.” Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground podcast on...

Joomla! Component YOOtheme Warp5 - yt_color Cross-Site Scripting

Joomla! Component YOOtheme Warp5 - ytcolor Cross-Site Scripting source: https://www.securityfocus.com/bid/37239/info The Warp5 component for Joomla! is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to...

Vulnerability Note VU#261869

Vulnerability Note VU261869 Clientless SSL VPN products break web browser domain-based security models Overview Clientless SSL VPN products from multiple vendors operate in a way that breaks fundamental browser security mechanisms. An attacker could use these devices to bypass authentication or...

Clientless SSL VPNs Break Web Browser Security Models

Clientless SSL VPN products from multiple vendors operate in a way that breaks fundamental browser security mechanisms, according to a warning from the U.S. Computer Emergency Response Team US-CERT. This security problem, discussed since at least 2006, could let an attacker could use these device...

Clientless SSL VPN products break web browser domain-based security models

Overview Clientless SSL VPN products from multiple vendors operate in a way that breaks fundamental browser security mechanisms. An attacker could use these devices to bypass authentication or conduct other web-based attacks. Description Web browsers enforce the same origin policy to prevent one...

WordPress WP-PHPList Plugin 2.10.2 - Cross-Site Scripting Vulnerability

WP-PHPList plugin is prone to a cross-site scripting vulnerability. Application fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authenticati...