WordPress Plugin Shopp - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/55817/info The Shopp plugin for WordPress is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data. Attackers can exploit these issues to disclose sensitive information, steal cookie information, execute...

Switchvox - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/55739/info Switchvox is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected...

Switchvox - Multiple HTML Injection Vulnerabilities

Switchvox - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/55739/info Switchvox is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and...

IBM Lotus Notes Traveler 8.5.1.x - Multiple Input Validation Vulnerabilities

IBM Lotus Notes Traveler 8.5.1.x - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/55740/info IBM Lotus Notes Traveler is prone to a URI-redirection vulnerability, multiple HTML-injection vulnerabilities and cross-site scripting vulnerabilities because it fails...

Google Chrome for Android 18.0.1025308之前版本多个安全漏洞

BUGTRAQ ID: 55523 Google Chrome是由Google开发的一款设计简单、高效的Web浏览工具。 Google Chrome for Android 18.0.1025308之前版本存在多个漏洞，攻击者可利用这些漏洞在浏览器上下文中执行任意代码，获取敏感信息、绕过同源策略、窃取Cookie身份验证凭证等其他攻击。 0 Google Chrome for Android 18.0.1025308 厂商补丁： Google ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.google.com...

Google Updates Chrome for Android, Fixes Several Vulnerabilities

Google has issued a security update for its Chrome operating system on Android devices, resolving seven medium-risk vulnerabilities and paying out a total of $3,500 in rewards to two researchers. On the Google Chrome Blog, software engineer Jay Civelli wrote that the update strengthens Chrome for...

Google Chrome for Android - Local Application Handling Cookie Theft

source: https://www.securityfocus.com/bid/55523/info Google Chrome for Android is prone to multiple vulnerabilities. Attackers may exploit these issues to execute arbitrary code in the context of the browser, obtain potentially sensitive information, bypass the same-origin policy, and steal...

Google Chrome for Android - Local Application Handling Cookie Theft

Google Chrome for Android - Local Application Handling Cookie Theft source: https://www.securityfocus.com/bid/55523/info Google Chrome for Android is prone to multiple vulnerabilities. Attackers may exploit these issues to execute arbitrary code in the context of the browser, obtain potentially...

PHPFox 3.0.1 - 'ajax.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/55405/info phpFox is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Dr. Web Control Center Admin UI Remote Script Code Injection

Dr. Web Control Center Admin UI Remote Script Code Injection ============================================================= Affected Products/Versions -------------------------- Product Name: Dr. Web Enterprise Server Version Number: 6.00.3.201111300 Product/Company Information...

JW Player - 'logo.link' Cross-Site Scripting

source: https://www.securityfocus.com/bid/55199/info JW Player is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

SaltOS - 'download.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/55117/info SaltOS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

Hotel Booking Portal 0.1 - Multiple SQL Injections Cross-Site Scripting

Hotel Booking Portal 0.1 - Multiple SQL Injections Cross-Site Scripting source: https://www.securityfocus.com/bid/54980/info Hotel Booking Portal is prone to multiple SQL-injection vulnerabilities and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied...

Barracuda Email Security Service - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/54773/info Barracuda Email Security Service is prone to multiple HTML-injection vulnerabilities because it fails to properly validate user-supplied input. An attacker may leverage these issues to inject hostile HTML and script code that would run in the...

cmseasy xss+后台getshell

简要描述： xss盗取 cookie进后台，某处可注入代码，传webshell 详细说明： 1:页面搜索位置出现xss未进行任何过滤,本来应该是反射型的xss，但后台的 "热门搜索词" 功能记录了用户搜索的所有记录； 当管理员查看 内容-热门搜索词 版块时，被xss攻击盗cookie； 2:利用盗取的cookie进后台，进入 模板-当前模板编辑 模块； 在模板编辑处任何一个html文件插入php可执行代码 ；再次访问首页，出现phpinfo 页面； 由于我测试的版本是4.8,wooyun前几天也报了一个搜索型xss，应该跟我的一样吧; 不过看官方的xss补丁，只适用于5.x的升级；...

Mozilla Firefox跨站脚本执行漏洞(CVE-2012-1966)

BUGTRAQ ID: 54577 CVE ID: CVE-2012-1966 Firefox是一款非常流行的开源WEB浏览器。Thunderbird是一个邮件客户端，支持IMAP、POP邮件协议以及HTML邮件格式。SeaMonkey是开源的Web浏览器、邮件和新闻组客户端、IRC会话客户端和HTML编辑器。 Firefox 14、Firefox ESR 10.0.6在实现上存在跨站脚本执行漏洞，攻击者可利用此漏洞在受影响站点的用户浏览器中执行任意脚本代码，窃取Cookie身份验证凭证。 0 Mozilla Firefox 4.x Mozilla Firefox 3.x 厂商补丁：...

AVA VoIP - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/54591/info AVA VoIP is prone to multiple security vulnerabilities because the application fails to sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context o...

AVA VoIP - Multiple Vulnerabilities

AVA VoIP - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/54591/info AVA VoIP is prone to multiple security vulnerabilities because the application fails to sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of a...

Simple Machines 2.0.2 - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/54456/info Simple Machines is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplied HTML and script cod...

Event Calender PHP - Multiple Input Validation Vulnerabilities

Event Calender PHP - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/54455/info Event Calender PHP is prone to multiple input validation vulnerabilities. Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-bas...