Web Wiz Forum 9.5 - admin_group_details.asp?mode Cross-Site Scripting

Web Wiz Forum 9.5 - admingroupdetails.asp?mode Cross-Site Scripting source: https://www.securityfocus.com/bid/30398/info Web Wiz Forums is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to...

mcGallery 1.1 - 'detail.php?lang' Cross-Site Scripting

source: https://www.securityfocus.com/bid/28587/info mcGallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in t...

retrobottega-xss.txt

---------------------------------------------------------------------------------- | . .. . | | ..\ | || | ||/ | / | | |/ | | /\ | ||| /|/||| /| /| | | // / / / / / | | | --------------------------------------------------------------------------------- Author: cybermilitant Site:...

msforums-xss.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 XSS in http://forums.microsoft.com/ - could lead to cookie/account stealing, information disclosure and more... Start e.g. here: http://forums.microsoft.com/Genuine/default.aspx?SiteID=25 Enter one of the following examples in searchbox of forum, the...

WebCT 4.1.5 - Email and Discussion Board Messages HTML Injection

source: https://www.securityfocus.com/bid/28107/info WebCT is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML or JavaScript code could run in the context of the...

[Full-disclosure] Apple Safari: cookie stealing

There is a vulnerability in Apple Safari, that allows an attacker to steal a cookie belonging to the arbitrary domain or/and fill the browser window with an arbitrary content, whereas the url bar and the browser's window title is derived from the selected domain. The flaw exists in the javascript...

[Full-disclosure] Assorted browser vulnerabilities

Hello, Will keep it brief. A couple of browser bugs, fresh from the oven, hand crafted with love: 1 Title : MSIE page update race condition CRITICAL Impact : cookie stealing / setting, page hijacking, memory corruption Demo : http://lcamtuf.coredump.cx/ierace/ ...aka the bait & switch...

Doop Content Management System 1.3.x - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/23482/info Doop Content Management System is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based authentication...

Advisory - Redirection Vulnerability in wp-login.php.

Vendor ------ Wordpress http://www.wordpress.org. Severity -------- Moderate. Dated ----- 03 March 2007. Versions Affected ----------------- All. Issue ----- The wp-login.php page redirects a user to arbitrary page after successful login by setting the redirectto url parameter. For example if a...

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability

On Thu, 15 Feb 2007, pdp architect wrote: I wander whether we can execute code on about:config or about:cache. Actually, there are several odd problems related to location updates and location.hostname specifically, including one scenario that apparently makes the script run with document.locatio...

flashChat 4.7.8 Cross Site Scripting Vulnerability

/ Flashchat 4.7.8 / Date of written Advisory: February 04, 2007 Product: Flash Chat = 4.7.8 Vendor: http://tufat.com/ Description: flashChat is a highly customizable PHP/MySQL based chat room script that is easily integrated into a website and mimics IRC in it's command structure Exploits /...

flashChat 4.7.8 Cross Site Scripting Vulnerability

/ Flashchat 4.7.8 / Date of written Advisory: February 04, 2007 Product: Flash Chat = 4.7.8 Vendor: http://tufat.com/ Description: flashChat is a highly customizable PHP/MySQL based chat room script that is easily integrated into a website and mimics IRC in it's command structure Exploits /...

shopsite-xss.txt

Hackers Center Security Group http://www.hackerscenter.com/ Doz's Security Advisory Desc: ShopSite Shopping Cart Multiple XSS Risk: Medium ShopSite™ is the easiest-to-use shopping cart software for small to medium-sized businesses. ShopSite ecommerce shopping cart is one of the most user-friendly...

JiRos Links Manager[injection sql & xss permanent]

vendor site:http://www.jiros.net/ product:JiRos Links Manager bug: injection sql & xss risk : medium injection sql: /openlink.asp?LinkID='sql /viewlinks.asp?CategoryID='sql xss permanent post: in: /submitlink.asp -Link Name: -Link URL: -Link Image: -Link Description: those xss are really dangerou...

CubeCart 3.0.x - '/admin/nav.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. A successful exploit of...

SoftBiz Banner Exchange Script 1.0 - lostpassword.php?PHPSESSID Cross-Site Scripting

SoftBiz Banner Exchange Script 1.0 - lostpassword.php?PHPSESSID Cross-Site Scripting source: https://www.securityfocus.com/bid/18735/info Softbiz Banner Exchange is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before displaying i...

[Kil13r-SA-20060609-1] Daum Search Cross-Site Scripting Vulnerability

Title: Kil13r-SA-20060609-1 Daum Search Cross-Site Scripting Vulnerability Author: Kil13r - http://www.kil13r.info/ Local / Remote: Remote Timeline: 2006/06/09 - Discovery 2006/06/09 - Vendor notification 2006/06/09 - Release Affected version: Not affected version: Description: Daum is internet...

PHPWebGallery 1.4.1 - picture.php Cross-Site Scripting

PHPWebGallery 1.4.1 - picture.php Cross-Site Scripting source: https://www.securityfocus.com/bid/17421/info PHPWebGallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...

PHP 4.x/5.0/5.1 - PHPInfo Large Input Cross-Site Scripting

source: https://www.securityfocus.com/bid/17362/info PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an...

CVE-2005-4685

Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a...