5673 matches found
CVE-2004-0871
Mozilla does not prevent cookies that are sent over an insecure channel HTTP from also being sent over a secure channel HTTPS/SSL in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."...
CVE-2004-0872
Opera does not prevent cookies that are sent over an insecure channel HTTP from also being sent over a secure channel HTTPS/SSL in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."...
PsNews index.php Multiple Parameter XSS
The remote server is running a version of PsNews a content management system which is older than 1.2. This version is affected by multiple cross-site scripting flaws. An attacker may exploit these to steal the cookies from legitimate users of this website. %NASLMINLEVEL 70300 C Tenable Network...
Keene Digital Media Server 1.0.2 - Cross-Site Scripting
Keene Digital Media Server 1.0.2 - Cross-Site Scripting source: https://www.securityfocus.com/bid/11111/info Keene Digital Media Server is prone to multiple cross-site scripting vulnerabilities. These issues span multiple scripts. The source of the problem is that affected scripts do not...
Keene Digital Media Server 1.0.2 - Cross-Site Scripting
source: https://www.securityfocus.com/bid/11111/info Keene Digital Media Server is prone to multiple cross-site scripting vulnerabilities. These issues span multiple scripts. The source of the problem is that affected scripts do not sufficiently sanitize externally supplied data before rendering ...
CuteNews 0.881.3.x - index.php Cross-Site Scripting
CuteNews 0.881.3.x - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/11097/info It is reported that CuteNews is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This issue cou...
CuteNews 0.88/1.3.x - 'index.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/11097/info It is reported that CuteNews is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This issue could permit a remote attacker to create a malicious UR...
CVE-2002-1151
CVE-2002-1151 affects Konqueror in KDE 2.2.2 and 3.0–3.0.3, where Konqueror’s cross-site scripting protection fails to correctly initialize domains on sub-frames/sub-iframes. This can allow remote attackers to run script and steal cookies from subframes that are in other domains. The issue is tie...
CVE-2002-1151
The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames and sub-iframes, which can allow remote attackers to execute script and steal cookies from subframes that are in other domains...
Newtelligence DasBlog 1.x - Request Log HTML Injection
Newtelligence DasBlog 1.x - Request Log HTML Injection source: https://www.securityfocus.com/bid/11086/info DasBlog is reportedly susceptible to an HTML injection vulnerability in its request log. This vulnerability is due to a failure of the application to properly sanitize user-supplied input...
Multiple Vulnerabilities in phpScheduleIt
--------------------------------------------------------------------------- Multiple Vulnerabilities in phpScheduleIt --------------------------------------------------------------------------- Author: Joxean Koret Date: 2004 Location: Basque Country...
[Full-Disclosure] Cross-Site Scripting Vulnerability in Newtelligence DasBlog
ERNW Security Advisory Cross-Site Scripting Vulnerability in Newtelligence DasBlog Author: Dominick Baier [email protected] 1. Summary: A XSS Cross-Site-Scripting Vulnerability in DasBlog's Event and Activity Viewer allows to inject and execute code on the client's machine. This allows an attacker t...
CVE-2002-1151: Undefined Security Weakness
The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames and sub-iframes, which can allow remote attackers to execute script and steal cookies from subframes that are in other domains...
CVE-2002-1348: Undefined Security Weakness
w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies...
Newtelligence DasBlog 1.x - Request Log HTML Injection
source: https://www.securityfocus.com/bid/11086/info DasBlog is reportedly susceptible to an HTML injection vulnerability in its request log. This vulnerability is due to a failure of the application to properly sanitize user-supplied input data before using it in the generation of dynamic web...
GLSA-200406-08 : Squirrelmail: Another XSS vulnerability
The remote host is affected by the vulnerability described in GLSA-200406-08 Squirrelmail: Another XSS vulnerability A new cross-site scripting XSS vulnerability in Squirrelmail-1.4.3rc1 has been discovered. In functions/mime.php Squirrelmail fails to properly sanitize user input. Impact : By...
GLSA-200408-07 : Horde-IMP: Input validation vulnerability for Internet Explorer users
The remote host is affected by the vulnerability described in GLSA-200408-07 Horde-IMP: Input validation vulnerability for Internet Explorer users Horde-IMP fails to properly sanitize email messages that contain malicious HTML or script code so that it is not safe for users of Internet Explorer...
GLSA-200405-16 : Multiple XSS Vulnerabilities in SquirrelMail
The remote host is affected by the vulnerability described in GLSA-200405-16 Multiple XSS Vulnerabilities in SquirrelMail Several unspecified cross-site scripting XSS vulnerabilities and a well-hidden SQL injection vulnerability were found. An XSS attack allows an attacker to insert malicious cod...
Nagl XOOPS Dictionary Module 1.0 - Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/11064/info Reportedly the XOOPS Dictionary Module by Nagle is affected by multiple cross-site scripting vulnerabilities. This issue is due to a failure of the application to properly sanitize user-supplied URI input. As a result of this issue and attacker...