CVE-2001-1419

AOL Instant Messenger AIM 4.7.2480 and earlier allows remote attackers to cause a denial of service application crash via an instant message that contains a large amount of "!--" HTML comments...

cutenews.txt

===================================================== cutenews 1.3.6: Remote XSS && Local Code Execution ===================================================== FraMe - frame at kernelpanik.org http://www.kernelpanik.org ===================================================== cutenews es un script...

CVE-2004-1634

showbug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information...

CVE-2004-1655

Cross-site scripting XSS vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 CMpid parameter in the comments module or 2 the subject or message fields in the notes module...

CVE-2005-0461

CVE-2005-0461 affects NewsBruiser 2.x prior to 2.6.1. The connected sources describe an unknown vulnerability that allows remote attackers to “take actions on comments.” The exact root cause is not specified in the provided documents, and there are no remediation details included here. Concrete e...

CVE-2004-1836

SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary SQL via the id parameter of the comments action...

CVE-2004-1949

SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via 1 the sif parameter to index.php in the Comments module or 2 timezoneoffset parameter to changeinfo.php in the YourAccount module...

DEBIAN-CVE-2004-1559

Multiple cross-site scripting XSS vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 redirectto, text, popupurl, or popuptitle parameters to wp-login.php, 2 redirecturl parameter to admin-header.php, 3 popuptitle, popupurl, content, or posttit...

PT-2004-3034 · Allwebscripts · Allwebscripts Mysqlguest

Name of the Vulnerable Software and Affected Versions: AllWebScripts MySQLGuest affected versions not specified Description: The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary HTML and PHP code via the Name, Email, Homepage, or...

HTML Comment 'href' Link Obfuscation

Binary data 2303.prm...

CVE-2004-1655

Cross-site scripting XSS vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 CMpid parameter in the comments module or 2 the subject or message fields in the notes module...

PT-2004-2607 · Fusion · Fusion News

Name of the Vulnerable Software and Affected Versions: Fusion News version 3.6.1 Description: The issue allows remote attackers to add user accounts if the administrator is logged in. This can be achieved by including an img bbcode tag in a comment that calls index.php with the signup action. The...

[Full-Disclosure] [SCAN Associates Sdn Bhd Security Advisory] Postnuke v 0.726 and below SQL injection

Products: Postnuke v 0.726 http://www.postnuke.com Date: 15 April 2004 Author: pokleyzz pokleyzzatscan-associates.net Contributors:skatscan-associates.net shaharilatscan-associates.net muniratscan-associates.net URL: http://www.scan-associates.net Summary: Postnuke v 0.726 and below SQL injection...

MSWordPW.txt

Hi ... There are several vulnerabilities published/discussed regarding MS Word MS Office in general, however, 'tis is the most "no brainer" I've discovered ... Vulnerability: Password protected document that has "tracked changes, comments or forms" password protected Vulnerable: MS Word Win2K/XP...

Invision Power Top Site List 1.1 RC 2 - SQL Injection

Invision Power Top Site List 1.1 RC 2 - SQL Injection Invision Power Top Site List SQL Injection Vendor: Invision Power Services Product: Invision Power Top Site List Version: = 1.1 RC 2 Website: http://www.invisiontsl.com/ BID: 9945 Description: Invision Power Top Site List is a flexible site...

CVE-2003-0287

Cross-site scripting XSS vulnerability in Movable Type before 2.6, and possibly other versions including 2.63, allows remote attackers to insert arbitrary web script or HTML via the Name textbox, possibly when the "Allow HTML in comments?" option is enabled...

CVE-2002-0958

Cross-site scripting vulnerability in browse.php for PHPReactor 1.2.7 allows remote attackers to execute script as other users via the go parameter in the comments section...

Blahz-DNS does not properly authenticate users before granting access to various configuration pages

Overview Blahz-DNS does not properly authenticate users. Description Blahz-DNS does not properly authenticate users. As a result, an attacker can gain access to various configuration pages. For more detailed information, please see the ppp-design advisory. --- Impact An attacker can gain access t...

Buffer Overflow in SGI IRIX syslogd

Overview A remotely exploitable buffer overflow in SGI IRIX syslogd may allow an attacker to crash syslogd or execute arbitrary code. Description There is a remotely exploitable buffer overflow in SGI IRIX syslogd. For more detailed information please see SGI Security Advisory 20020405-01-I. ---...

DEBIAN-CVE-2002-1337

Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c...