3649 matches found
CVE-2007-0231
Cross-site scripting XSS vulnerability in Movable Type MT 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field...
Cross site scripting
Cross-site scripting XSS vulnerability in Movable Type MT 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field...
CVE-2007-0231
Cross-site scripting XSS vulnerability in Movable Type MT 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field...
CVE-2007-0231
CVE-2007-0231 describes a cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33 where, if nofollow is disabled and unmoderated comments are enabled, a remote attacker can inject arbitrary web script or HTML via the Comments field. The vulnerability concerns Movable Type 3.33 and is t...
[SA23669] Movable Type "nofollow" Plugin Comment Script Insertion
TITLE: Movable Type "nofollow" Plugin Comment Script Insertion SECUNIA ADVISORY ID: SA23669 VERIFY ADVISORY: http://secunia.com/advisories/23669/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: Movable Type 3.x http://secunia.com/product/5753/ DESCRIPTION: A...
AllMyGuests <= 0.3.0 (AMG_serverpath) Remote Inclusion Vulnerabilities
No description provided by source. AllMyGuests 3.0 Remote File Inclusion Vulnerability Software: AllMyGuests Version: 3.0 Download: http://download.php-resource.net/AllMyGuests/AllMyGuests0.3.0.zip Found By: beks Bug In: /include/submit.inc.php /admin/index.php /include/cmsubmit.inc.php...
security flaw
Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption...
Mozilla Firefox SVG Processing Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists in the browser's handling of SVG comment objects...
pHNews Comments.PHP本地文件包含漏洞
pHNews是一款基于PHP的WEB应用程序。 pHNews不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限查看系统文件内容。 问题是由于'Comments.PHP'脚本对用户提交的'templatesdir'参数缺少过滤，提交包含多个"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB进程权限查看系统文件内容。 pHMicroboard pHNews alpha 1 http://www.phnews.org/ http://www.example.com/path/modules/comments.php?templatesdir=LFI...
IwebNegar Comments.PHP注入漏洞
IwebNegar是一款基于PHP的WEB应用程序。 IwebNegar不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是由于'Comments.PHP'脚本对用户提交的'id'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 iWebNegar iWebNegar 1.1 http://iwebnegar.co.sr/ http://www.example.com/comments.php?id=SQL Query...
PT-2006-6739 · Unknown · Activenews Manager
Name of the Vulnerable Software and Affected Versions: ActiveNews Manager affected versions not specified Description: The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerabilities can be exploited...
CVE-2006-5975
Multiple cross-site scripting XSS vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbitrary web script or HTML via the 1 Name, 2 URL, or 3 Comments field...
EUVD-2006-5958
Multiple cross-site scripting XSS vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbitrary web script or HTML via the 1 Name, 2 URL, or 3 Comments field...
eggblog=> 3.1.0 Cross Site Scripting
""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ DigitaL Hacking TeaM eggblog=...
Blogme v3 [admin login bypass & xss (post)]
vendor site:http://www.drumster.net/ product:Blogme v3 bug:login bypass & xss post risk:high admin login bypass : user : ' or '1' = '1 passwd: 1'='1' ro ' xss post : in: /comments.asp?blog=85 vulnerables fields: - Name - URL - Comments laurent gaffie & benjamin mosse http://s-a-p.ca/ contact:...
BlogMe 3.0 (XSS/Auth Bypass) Multiple Remote Vulnerabilities
Exploit for unknown platform in category web applications ============================================================ BlogMe 3.0 XSS/Auth Bypass Multiple Remote Vulnerabilities ============================================================ blogme v3 admin login bypass & xss post vendor...
blogme 3.0 - Cross-Site Scripting Authentication Bypass
blogme 3.0 - Cross-Site Scripting Authentication Bypass blogme v3 admin login bypass & xss post vendor site:http://www.drumster.net/ product:blogme v3 bug:login bypass & xss post risk:high admin login bypass : user : ' or '1' = '1 passwd: 1'='1' ro ' xss post : in: /comments.asp?blog=85 vulnerabl...
CVE-2006-5864
Stack-based buffer overflow in the psgettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript PS file with certain headers that contain long comments, as demonstrated using the 1 DocumentMedia, 2...
CVE-2006-5864
Stack-based buffer overflow in the psgettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript PS file with certain headers that contain long comments, as demonstrated using the 1 DocumentMedia, 2...