CVE-2012-3293

CVE-2012-3293 is an XSS flaw in IBM WebSphere Application Server’s Administrative Console. It affects WAS versions 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1, allowing remote attackers to inject arbitrary script via FRAME/cross-frame contexts. IBM...

CVE-2012-3293

Cross-site scripting XSS vulnerability in the Administrative Console in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME...

CVE-2012-3293: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Administrative Console in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME...

PT-2012-4629

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1.x through 6.1.0.44 IBM WebSphere Application Server versions 7.0.x through 7.0.0.24 IBM WebSphere Application Server versions 8.0.x through 8.0.0.3 IBM WebSphere Application Server versions 8.5.x...

CVE-2012-2280

EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."...

CVE-2012-2280

The CVE-2012-2280 entry concerns a Cross frame scripting vulnerability in EMC RSA Authentication Manager 7.1 (before SP4 P14) and RSA SecurID Appliance 3.0 (before SP4 P14). The issue allows remote attackers to inject arbitrary web script/HTML via unspecified vectors due to improper frame handlin...

CVE-2012-2280: Undefined Security Weakness

EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."...

PT-2012-3919

Name of the Vulnerable Software and Affected Versions EMC RSA Authentication Manager versions 7.1 before SP4 P14 RSA SecurID Appliance versions 3.0 before SP4 P14 Description The issue is related to a Cross frame scripting vulnerability, which allows remote attackers to inject arbitrary web scrip...

Cross site scripting

Google Chrome before 13.0.782.107 does not prevent calls to functions in other frames, which allows remote attackers to bypass intended access restrictions via a crafted web site, related to a "cross-frame function leak."...

CVE-2011-2795

Google Chrome before 13.0.782.107 does not prevent calls to functions in other frames, which allows remote attackers to bypass intended access restrictions via a crafted web site, related to a "cross-frame function leak."...

CVE-2011-2795

Google Chrome before 13.0.782.107 does not prevent calls to functions in other frames, which allows remote attackers to bypass intended access restrictions via a crafted web site, related to a "cross-frame function leak."...

CVE-2011-2795: Undefined Security Weakness

Google Chrome before 13.0.782.107 does not prevent calls to functions in other frames, which allows remote attackers to bypass intended access restrictions via a crafted web site, related to a "cross-frame function leak."...

PT-2011-4098

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 13.0.782.107 Description The issue allows remote attackers to bypass intended access restrictions via a crafted web site, related to a "cross-frame function leak." This occurs because Google Chrome does not...

CVE-2011-2795

Google Chrome before 13.0.782.107 is vulnerable to a cross-frame function leak that allows remote attackers to bypass same-origin access restrictions via a crafted web site; remediation is to upgrade to 13.0.782.107 or later.

CVE-2011-2795

Removed by vendor...

Penetration Tester XSSer v1.0 - New Version Download

All of you web application penetration testers, check out this release of XSSer version 1.0! From this release, the author plans to rename XSSer to "The Mosquito". Our first post regarding XSSer can be found here. "XSSer is an open source penetration testing tool that automates the process of...

Internet Explorer Cross Frame Scripting Restriction Bypass (CVE-2004-2383)

Microsoft Internet Explorer, a web browser developed and maintained by Microsoft Corporation, is the most widely used Internet browser. There is a vulnerability in the way Internet Explorer handles interaction between frames within a web page. It is possible for a malicious server to bypass...

[HACKATTACK Advisory 25012009]ConPresso CMS 4.07 - Session Fixation, XFS, XSS

HACKATTACK Advisory 25012009ConPresso CMS 4.07 - Session Fixation, XFS, XSS Details Product: ConPresso CMS 4.07 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.conpresso.de/ Vendor-Status: informed Advisory-Status: not yet published Credits Discovered by: David Vieira-Kurz...

ConPresso CMS 4.07 Session Fixation / XSS

HACKATTACK Advisory 25012009ConPresso CMS 4.07 - Session Fixation, XFS, XSS Details Product: ConPresso CMS 4.07 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.conpresso.de/ Vendor-Status: informed Advisory-Status: not yet published Credits Discovered by: David Vieira-Kurz...

Oempro index.php FormValue_Email Parameter SQL Injection Authentication Bypass

The remote host is running Oempro, a commercial list management and email marketing application written in PHP. The installed version of Oempro fails to sanitize user-supplied input to the 'FormValueEmail' parameter of the 'index.php' script before using it in a database query. An unauthenticated...