Unfixed XSS vulnerability at www.learningtechnologies.ac.uk

Security researcher Hotpockets, has submitted on 30/05/2007 a cross-site-scripting XSS vulnerability affecting www.learningtechnologies.ac.uk, which at the time of submission ranked 1180989 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on...

Cisco CallManager Web Interface Input Validation Bypass Vulnerability

Cisco CallManager versions 4.31 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to bypass security restrictions and conduct cross-site scripting attacks. This vulnerability exists due to insufficient sanitization of user-supplied input to the CallManager web...

Unfixed XSS vulnerability at www.ukleader.org.uk

Security researcher Hotpockets, has submitted on 18/05/2007 a cross-site-scripting XSS vulnerability affecting www.ukleader.org.uk, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 18/05/2007. It is...

jetbox-inject.txt

netVigilance Security Advisory 26 Jetbox CMS version 2.1 E-Mail Injection Vulnerability Description: Jetbox content management system is seriously tested on usability & has a professional intuitive interface. The system is role based, with workflow and module orientated. All content is fully...

Jetbox CMS version 2.1 E-Mail Injection Vulnerability

netVigilance Security Advisory 26 Jetbox CMS version 2.1 E-Mail Injection Vulnerability Description: Jetbox content management system is seriously tested on usability & has a professional intuitive interface. The system is role based, with workflow and module orientated. All content is fully...

Crlf injection

CRLF injection vulnerability in formmail.php in Jetbox CMS 2.1 might allow remote attackers to inject arbitrary e-mail headers via LF %0A sequences in the subject parameter, a related issue to CVE-2007-1898...

CVE-2007-2731

Jetbox CMS 2.1 is affected by a CRLF injection in formmail.php, allowing remote attackers to inject arbitrary e-mail headers via LF sequences in the subject parameter. This is linked to CVE-2007-1898. The NetVigilance advisory notes that exploitation requires PHP register_globals to be On; a work...

Stalker CommuniGate Pro crossite scripting

Crossite scripting via e-mail within Internet Explorer...

CVE-2006-3456

The Symantec NAVOPTS.DLL ActiveX control aka Symantec.Norton.AntiVirus.NAVOptions 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via...

CVE-2007-1262

Multiple cross-site scripting XSS vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the 1 data: URI in an HTML e-mail attachment or 2 various non-ASCII character sets that are not properly filtered when viewed...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the 1 data: URI in an HTML e-mail attachment or 2 various non-ASCII character sets that are not properly filtered when viewed...

Cross site scripting

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an...

Design/Logic Flaw

admin/sendmod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and listid fields; and send...

Moderate: Red Hat Security Advisory: php security update

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A...

Unfixed XSS vulnerability at www.starads.in

Security researcher TreX, has submitted on 04/12/2007 a cross-site-scripting XSS vulnerability affecting www.starads.in, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/12/2007. It is currently unfixe...

Cross site scripting

Cross-site scripting XSS vulnerability in the Active Content Filter feature in Domino Web Access DWA in IBM Lotus Notes before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via a multipart/related e-mail message, a different issue than CVE-2006-4843...

CVE-2007-1941

Cross-site scripting XSS vulnerability in the Active Content Filter feature in Domino Web Access DWA in IBM Lotus Notes before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via a multipart/related e-mail message, a different issue than CVE-2006-4843...

CVE-2007-1941

CVE-2007-1941 describes a Cross-site scripting (XSS) vulnerability in the Active Content Filter feature of Domino Web Access (DWA) in IBM Lotus Notes. Affected software: IBM Lotus Domino with DWA before 6.5.6 and 7.x before 7.0.2 FP1. The issue allows remote attackers to inject arbitrary web scri...

CVE-2007-1941

Cross-site scripting XSS vulnerability in the Active Content Filter feature in Domino Web Access DWA in IBM Lotus Notes before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via a multipart/related e-mail message, a different issue than CVE-2006-4843...

Unfixed XSS vulnerability at www.dpsg-netzwerk-oe.de

Security researcher BackDoor, has submitted on 04/11/2007 a cross-site-scripting XSS vulnerability affecting www.dpsg-netzwerk-oe.de, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/11/2007. It is...