ConPresso CMS 4.07 - Multiple Remote Vulnerabilities

source: https://www.securityfocus.com/bid/33436/info ConPresso CMS is prone to multiple remote vulnerabilities: - A cross-site scripting vulnerability - A cross-domain scripting vulnerability - A session-fixation vulnerability An attacker can exploit these issues to execute arbitrary script code...

ConPresso CMS 4.07 - Multiple Remote Vulnerabilities

ConPresso CMS 4.07 - Multiple Remote Vulnerabilities source: https://www.securityfocus.com/bid/33436/info ConPresso CMS is prone to multiple remote vulnerabilities: - A cross-site scripting vulnerability - A cross-domain scripting vulnerability - A session-fixation vulnerability An attacker can...

Rich editing allows cross domain scripting – Opera Security Advisories

Rich editing allows cross domain scripting – Opera Security Advisories OPCOM Team | December 16, 2008 Problem Description Rich editing using designMode allows page contents to be edited. Pages can use this ability to inject scripts into pages from other domains. This allows cross domain scripting...

Rich editing allows cross domain scripting

Rich editing using designMode allows page contents to be edited. Pages can use this ability to inject scripts into pages from other domains. This allows cross domain scripting...

Microsoft XML Core Services DTD Cross-Domain Scripting PoC MS08-069

No description provided by source. html body KB955218 - CVE-2008-4029 - JA script type="text/javascript" var dom = new ActiveXObject"Msxml2.DOMDocument.3.0"; dom.async = false; var url = "http://www.milw0rm.com/forfun.dtd"; var xml = "!DOCTYPE pwn SYSTEM '" + url + "'"; if dom.loadXMLxml == 0...

Microsoft XML Core Services DTD - Cross-Domain Scripting (MS08-069)

Microsoft XML Core Services DTD - Cross-Domain Scripting MS08-069 KB955218 - CVE-2008-4029 - JA var dom = new ActiveXObject"Msxml2.DOMDocument.3.0"; dom.async = false; var url = "http://www.milw0rm.com/forfun.dtd"; var xml = ""; if dom.loadXMLxml == 0 alert"Blue or Red Pill? " +...

Microsoft XML Core Services DTD - Cross-Domain Scripting (MS08-069)

KB955218 - CVE-2008-4029 - JA var dom = new ActiveXObject"Msxml2.DOMDocument.3.0"; dom.async = false; var url = "http://www.milw0rm.com/forfun.dtd"; var xml = ""; if dom.loadXMLxml == 0 alert"Blue or Red Pill? " + dom.parseError.srcText; milw0rm.com 2008-11-23...

CVE-2008-4029

CVE-2008-4029 relates to a cross-domain scripting vulnerability in Microsoft XML Core Services 3.0/4.0 (MSXML) used by Internet Explorer. The issue stems from improper error checking for external DTDs in XML documents, enabling a crafted XML to leak information to another domain. Microsoft MS08-0...

Microsoft XML Core Services Remote Code Execution Vulnerability (955218)

This host is missing a critical security update according to Microsoft Bulletin MS08-069. OpenVAS Vulnerability Test $Id: secpodms08-069900058.nasl 5370 2017-02-20 15:24:26Z cfi $ Description: Microsoft XML Core Services Remote Code Execution Vulnerability 955218 Authors: Chandan S Copyright:...

Cumulative Security Update for Internet Explorer (956390)

This host is missing critical security update according to Microsoft Bulletin MS08-058. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Cumulative Security Update for Internet Explorer (956390)

This host is missing critical security update according to Microsoft Bulletin MS08-058. OpenVAS Vulnerability Test $Id: secpodms08-058900054.nasl 5934 2017-04-11 12:28:28Z antu123 $ Description: Cumulative Security Update for Internet Explorer 956390 Authors: Chandan S Copyright: Copyright C 2008...

Gentoo Security Advisory GLSA 200712-22 (opera)

The remote host is missing updates announced in advisory GLSA 200712-22. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD Ports: thunderbird

The remote host is missing an update to the system as announced in the referenced advisory. VID b2e6d1d6-1339-11d9-bc4a-000c41e2cdad OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Microsoft Internet Explorer 7/8 Beta 1 - Frame Location Cross Domain Security Bypass

source: https://www.securityfocus.com/bid/29986/info Microsoft Internet Explorer is prone to a cross-domain scripting security-bypass vulnerability because the application fails to properly enforce the same-origin policy. An attacker can exploit this issue to change the location of a frame from a...

Mozilla Firefox vulnerable to HTTP response splitting

Overview 1Mozilla Firefox contains a vulnerability in the way it interprets HTTP 1.0 responses from a server. 2Mozilla Firefox, a web browser from Mozilla Corporation and Mozilla Japan, fails to properly handles multiple HTTP headers in server responses. Impact 1If a user views malicious web page...

Adobe Flash Script Injection Cross Domain Scripting Vulnerability

This vulnerability allows remote attackers to inject scripts across domains through vulnerable versions of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists in the handling of scripts injected via Flash...

[MSA02240108] IE7 allows overwriting of several headers leading to Http request Splitting and smuggling.

MSA01240108: IE7 allows overwriting of several headers leading to Http request Splitting and smuggling. Date: March 21th, 2008 Tested Versions: Internet Explorer 7.0.5730.11 Tested OS: Windows XP Professional SP2 Italian Minded Security ReferenceID: MSA02240108 Credits: Discovery by Stefano Di...

openSUSE 10 Security Update : opera (opera-4858)

Opera released version 9.25 of their browser to fix various security problems. CVE-2007-6520: Fixed an issue where plug-ins could be used to allow cross domain scripting, as reported by David Bloom. Details will be disclosed at a later date. CVE-2007-6521: Fixed an issue with TLS certificates tha...

GLSA-200712-22 : Opera: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200712-22 Opera: Multiple vulnerabilities David Bloom reported two vulnerabilities where plug-ins CVE-2007-6520 and Rich text editing CVE-2007-6522 could be used to allow cross domain scripting. Alexander Klink Cynops GmbH...

Opera: Multiple vulnerabilities

Background Opera is a fast Web browser that is available free of charge. Description David Bloom reported two vulnerabilities where plug-ins CVE-2007-6520 and Rich text editing CVE-2007-6522 could be used to allow cross domain scripting. Alexander Klink Cynops GmbH discovered an issue with TLS...