CVE-2003-0459

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites...

DSA-361 kdelibs, kdelibs-crypto - several vulnerabilities

Bulletin has no description...

ISA Server - Error Page Cross Site Scripting

======================================================================== = ISA Server - Error Page Cross Site Scripting = = [email protected] = http://www.security-assessment.com = = MS Bulletin posted: July 16, 2003 = http...

XSS in OWA allows stealing windows domain user credentials

-2 vulnerabilities in OWA. -Vendor contacted Microsoft Outlook Web Access comes with a feature that allows script filtering on HTML formatted mail attachments.It is possible for an attacker to make a request in a particular way so that OWA does not filter the attachment causing the script to...

Microsoft Internet Explorer 5 - Custom HTTP Error HTML Injection

source: https://www.securityfocus.com/bid/7939/info An issue has been reported for Microsoft Internet Explorer that may result in HTML injection attacks. The vulnerability exists when IE is used to display custom HTTP error messages also known as "Friendly HTTP error messages". Due to some errors...

PostNuke 0.723 - user.php UNAME Cross-Site Scripting

PostNuke 0.723 - user.php UNAME Cross-Site Scripting source: https://www.securityfocus.com/bid/7901/info The PostNuke 'user.php' script does not sufficiently sanitize data supplied via URI parameters, making it prone to cross-site scripting attacks. This could allow for execution of hostile HTML...

OpenBB index.php CID Parameter SQL Injection

The remote host seems to be running OpenBB, a forum management system. There is a bug which allows an attacker to inject SQL command when passing a single quote ' to the CID argument of the file index.php, as in : GET /index.php?CID=' An attacker may use this flaw to gain credentials or to modify...

EZ Publish 2.2.73.0 - Multiple Cross-Site Scripting Vulnerabilities

EZ Publish 2.2.73.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/7348/info Several cross site scripting vulnerabilities have been reported for eZ Publish. These vulnerabilities are due to insufficient sanitization of user-supplied data submitted to eZ...

CVE-2003-0047

SSH2 clients for VanDyke 1 SecureCRT 4.0.2 and 3.4.7, 2 SecureFX 2.1.2 and 2.0.4, and 3 Entunnel 1.0.2 and earlier, do not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials...

CVE-2003-0046

AbsoluteTelnet SSH2 client does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials...

Sambar Server 5.x - results.stm Cross-Site Scripting

Sambar Server 5.x - results.stm Cross-Site Scripting source: https://www.securityfocus.com/bid/6643/info Sambar Server does not adequately filter some HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script...

CVE-2002-1678

Cross-site scripting XSS vulnerability in memberlist.php in Jelsoft vBulletin 2.0 rc 2 through 2.2.4 allows remote attackers to steal authentication credentials by injecting script into $letterbits...

YaBB 1 Gold SP 1 - YaBB.pl Cross-Site Scripting

YaBB 1 Gold SP 1 - YaBB.pl Cross-Site Scripting source: https://www.securityfocus.com/bid/6272/info A cross-site scripting vulnerability has been reported in the YaBB forum. This vulnerability is due to insufficient sanitization of URI parameters in some scripts. As a result, it is possible for a...

KMMail 1.0 - E-Mail HTML Injection

source: https://www.securityfocus.com/bid/6013/info kmMail does not sufficiently sanitize HTML and script code from the body of e-mail messages. As a result, an attacker may send a malicious message to a user of kmMail that includes arbitrary HTML and script code. This may allow an attacker to...

CVE-2002-0581

WorkforceROI Xpede 4.1 allows remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database via the Qry parameter in the sprc.asp script...

Phorum 3.3.2 - Cross-Site Scripting

Phorum 3.3.2 - Cross-Site Scripting source: https://www.securityfocus.com/bid/4767/info Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems. The 'header.php' and 'footer.php' components of Phorum do not santize the client-suppli...

MyGuestbook 1.0 - Script Injection

MyGuestbook 1.0 - Script Injection source: https://www.securityfocus.com/bid/4651/info MyGuestbook is freely available guestbook software. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. MyGuestbook does not adequately filter script code from various...

Remote Desktop Protocol Service Detection

The Remote Desktop Protocol allows a user to remotely obtain a graphical login and therefore act as a local user on the remote host. If an attacker gains a valid login and password, this service could be used to gain further access on the remote host. An attacker may also use this service to moun...

X Display Manager Control Protocol (XDMCP) Detection

The X Display Manager Control Protocol XDMCP service allows a Unix user to remotely obtain a graphical X11 login and therefore act as a local user on the remote host. If an attacker can gain a valid login and password, this service could be used to gain further access on the remote host. An...

ReBB 1.0 - Image Tag Cross-Agent Scripting

source: https://www.securityfocus.com/bid/4220/info ReBB is web forum software which will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. It is written in PHP and may be back-ended by a number of databases. ReBB allows users to include images in forum messages...