[Full-disclosure] iDefense Security Advisory 03.28.07: IBM Lotus Domino Web Access Cross Site Scripting Vulnerability

IBM Lotus Domino Web Access Cross Site Scripting Vulnerability iDefense Security Advisory 03.28.07 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 28, 2007 I. BACKGROUND IBM Lotus Domino Web Access is a web-based messaging and collaboration interface for the Lotus Domino server. More...

CVE-2007-1717

The mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 truncates e-mail messages at the first ASCIIZ '\0' byte, which might allow context-dependent attackers to prevent intended information from being delivered in e-mail messages. NOTE: this issue might be security-relevant in cases...

CVE-2006-7176

The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not reject the "localhost.localdomain" domain name for e-mail messages that come from external hosts, which might allow remote attackers to spoof messages...

CVE-2006-7176

The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not reject the "localhost.localdomain" domain name for e-mail messages that come from external hosts, which might allow remote attackers to spoof messages...

CVE-2006-7176

The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not reject the "localhost.localdomain" domain name for e-mail messages that come from external hosts, which might allow remote attackers to spoof messages...

Unfixed XSS vulnerability at www.reflexpowerclean.co.uk

Security researcher Vagrant, has submitted on 18/03/2007 a cross-site-scripting XSS vulnerability affecting www.reflexpowerclean.co.uk, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 18/03/2007. It is...

Unfixed XSS vulnerability at www.blogdigger.com

Security researcher Narcoticxs, has submitted on 17/03/2007 a cross-site-scripting XSS vulnerability affecting www.blogdigger.com, which at the time of submission ranked 24128 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 18/03/2007. It is...

Unfixed XSS vulnerability at drtr.test.cwfservice.net

Security researcher MaXWeL, has submitted on 16/03/2007 a cross-site-scripting XSS vulnerability affecting drtr.test.cwfservice.net, which at the time of submission ranked 305421 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/03/2007. It is...

Unfixed XSS vulnerability at hr.cch.com

Security researcher MaXWeL, has submitted on 16/03/2007 a cross-site-scripting XSS vulnerability affecting hr.cch.com, which at the time of submission ranked 37478 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/03/2007. It is currently...

Unfixed XSS vulnerability at www.egosurf.org

Security researcher DjSedat, has submitted on 14/03/2007 a cross-site-scripting XSS vulnerability affecting www.egosurf.org, which at the time of submission ranked 195874 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 14/03/2007. It is current...

Unfixed XSS vulnerability at sslsites.de

Security researcher Hanno Boeck, has submitted on 03/12/2007 a cross-site-scripting XSS vulnerability affecting sslsites.de, which at the time of submission ranked 119867 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/12/2007. It is current...

Unfixed XSS vulnerability at www.usedcartrader.co.uk

Security researcher INull, has submitted on 03/08/2007 a cross-site-scripting XSS vulnerability affecting www.usedcartrader.co.uk, which at the time of submission ranked 125476 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/08/2007. It is...

Integer overflow

Integer overflow in Mozilla Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allows remote attackers to trigger a buffer overflow and possibly execute arbitrary code via a text/enhanced or text/richtext e-mail message with an extremely long line...

CVE-2007-1282: Undefined Security Weakness

Integer overflow in Mozilla Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allows remote attackers to trigger a buffer overflow and possibly execute arbitrary code via a text/enhanced or text/richtext e-mail message with an extremely long line...

CVE-2006-5877

Removed by vendor...

Unfixed XSS vulnerability at www.dreamsmagazine.net

Security researcher St@rExT, has submitted on 23/02/2007 a cross-site-scripting XSS vulnerability affecting www.dreamsmagazine.net, which at the time of submission ranked 1447192 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/02/2007. It is...

Microsoft Security Advisory (933052) Vulnerability in Microsoft Word Could Allow Remote Code Executio

Microsoft Security Advisory 933052 Vulnerability in Microsoft Word Could Allow Remote Code Execution Published: February 14, 2007 Microsoft is investigating new public reports of very limited, targeted attacks against Microsoft Word “zero-day” using a vulnerability in Microsoft Office 2000 and...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MailEnable Professional before 2.37 allow remote attackers to inject arbitrary Javascript script via 1 e-mail messages and 2 the ID parameter to a right.asp, b Forms/MAI/list.asp, and c Forms/VCF/list.asp in mewebmail/base/default/lang/EN/...

CVE-2007-0651

Multiple cross-site scripting XSS vulnerabilities in MailEnable Professional before 2.37 allow remote attackers to inject arbitrary Javascript script via 1 e-mail messages and 2 the ID parameter to a right.asp, b Forms/MAI/list.asp, and c Forms/VCF/list.asp in mewebmail/base/default/lang/EN/...

CVE-2007-0651

Multiple cross-site scripting XSS vulnerabilities in MailEnable Professional before 2.37 allow remote attackers to inject arbitrary Javascript script via 1 e-mail messages and 2 the ID parameter to a right.asp, b Forms/MAI/list.asp, and c Forms/VCF/list.asp in mewebmail/base/default/lang/EN/...