DEBIAN-CVE-2017-1000487

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings...

Cross site scripting

Cross-site scripting XSS vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes...

Cross-site Scripting (XSS)

sanitize-html is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the use of double quotes...

ShopEx an injection vulnerability fix is not complete-bug warning-the black bar safety net

In the clouds to see this http://wooyun.org/bugs/wooyun-2014-088313 So hand cheap points to open, found that the repair is not complete. It turned out what seemed like protection are not, now parameter to add the double quotes and braces to protect, turned into"xxx"like this, can still be injecte...

Juniper Networks Junos OS Privilege Escalation Vulnerability

Local privilege escalation vulnerability in Junos OS. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if...

Active Collab "chat module" <= 2.3.8 - Remote PHP Code Injection Exploit

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

Uzbey: Album image XSS

There's an XSS in the album script caused by insufficient escaping of double quotes. PoC: https://staging.uzbey.com/album/image/679/1139%22%3E%3Ch1%3ESurprise!%3Cimg%20src=0%20onerror=%22alertdocument.domain%22%3E...

Active Collab "chat module" Remote PHP Code Injection Exploit

This module exploits an arbitrary code injection vulnerability in the chat module that is part of Active Collab versions 2.3.8 and earlier by abusing a pregreplace using the /e modifier and its replacement string using double quotes. The vulnerable function can be found in...

Active Collab "chat module" <= 2.3.8 Remote PHP Code Injection Exploit

Exploit for php platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' cla...

Oracle Java Web Start java-vm-args Command Argument Injection Remote Code Execution

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way Java Webstar...

Improve cookie parsing for tomcat5

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote " characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable...

Improve cookie parsing for tomcat5

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote " characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable...

Ubuntu: Security Advisory (USN-493-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

cnn-xss.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear CNN, I recently discovered a security vulnerability on the www.cnn.com website. I believe the vulnerability can be used by a remote user to alter content on www.cnn.com. On 10 Nov 2008, I wrote to...

tomcat handling of cookie values

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

PT-2006-3920 · Winscp · Winscp

Name of the Vulnerable Software and Affected Versions: WinSCP version 3.8.1 build 328 Description: The issue allows remote attackers to upload or download arbitrary files via encoded spaces and double-quote characters in a scp or sftp URI. Recommendations: For WinSCP version 3.8.1 build 328, upda...

PT-2006-3038 · Microsoft +1 · Outlook +1

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox version 1.0.6 Description: The issue allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " double quote characters in a mailto: scheme handler. This could potentially be used to...