CVE-2005-1499

delcomment.php in myBloggie 2.1.1 allows remote attackers to delete arbitrary comments by modifying the commentid parameter...

CVE-2005-1511

PwsPHP 1.2.2 allows remote attackers to bypass authentication and post arbitrary comments via the Pseudo cookie...

CVE-2005-1511

PwsPHP 1.2.2 allows remote attackers to bypass authentication and post arbitrary comments via the Pseudo cookie...

CVE-2005-1499: Undefined Security Weakness

delcomment.php in myBloggie 2.1.1 allows remote attackers to delete arbitrary comments by modifying the commentid parameter...

CVE-2004-1949: Undefined Security Weakness

SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via 1 the sif parameter to index.php in the Comments module or 2 timezoneoffset parameter to changeinfo.php in the YourAccount module...

CVE-2004-1836: Undefined Security Weakness

SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary SQL via the id parameter of the comments action...

CVE-2005-0461

Unknown vulnerability in NewsBruiser 2.x before 2.6.1 allows remote attackers to "take actions on comments."...

CVE-2005-1140

The connected documents confirm CVE-2005-1140 is an XSS vulnerability in myBloggie 2.1.1 that allows remote attackers to inject arbitrary script/HTML via comments. Affected product: myBloggie 2.1.1. Underlying issue is cross-site scripting in the comments handling. CVSS-derived context from NVD l...

CVE-2005-1140

Cross-site scripting XSS vulnerability in myBloggie 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the comments...

myBloggie 2.1.1

myBloggie 2.1.1 Vendor: http://www.mywebland.com/ When the comments are posted there's no check for "script" tags allowing a script injection attack. Proof of Concept scriptalert"Hi world!";/script ..-= DominusVis =-.. Infektion Group Brazil...

CVE-2005-1140: Undefined Security Weakness

Cross-site scripting XSS vulnerability in myBloggie 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the comments...

CVE-2005-1140

Cross-site scripting XSS vulnerability in myBloggie 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the comments...

Code insertion in Blogger comments

Having notified Blogger of this twice over the course of a number of months, and not seeing them take any action beyond saying that they'll look at it or warn their users, I think it's time to warn people. Under the following conditions, Blogger weblogs are vulnerable to executable code insertion...

CVE-2001-1419

AOL Instant Messenger AIM 4.7.2480 and earlier allows remote attackers to cause a denial of service application crash via an instant message that contains a large amount of "!--" HTML comments...

cutenews.txt

===================================================== cutenews 1.3.6: Remote XSS && Local Code Execution ===================================================== FraMe - frame at kernelpanik.org http://www.kernelpanik.org ===================================================== cutenews es un script...

CVE-2004-1655

Cross-site scripting XSS vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 CMpid parameter in the comments module or 2 the subject or message fields in the notes module...

CVE-2004-1634

showbug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information...

CVE-2004-1655: Undefined Security Weakness

Cross-site scripting XSS vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 CMpid parameter in the comments module or 2 the subject or message fields in the notes module...

CVE-2004-1529: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary web script via the 1 type, 2 day, 3 month, or 4 year parameters in a Preview operation, or 5 event comments...

CVE-2005-0461

CVE-2005-0461 affects NewsBruiser 2.x prior to 2.6.1. The connected sources describe an unknown vulnerability that allows remote attackers to “take actions on comments.” The exact root cause is not specified in the provided documents, and there are no remediation details included here. Concrete e...