Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to 1 applications/applications.jsf, 2 configuration/configuration.jsf, 3 customMBeans/customMBeans.jsf, ...

CVE-2009-1554

Cross-site scripting XSS vulnerability in ThemeServlet.java in Sun Woodstock 4.2, as used in Sun GlassFish Enterprise Server and other products, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 string in the PATHINFO, which is displayed on the 404 error page, as...

CVE-2009-1553

CVE-2009-1553 covers multiple XSS vulnerabilities in Sun GlassFish Enterprise Server 2.1 Admin Console. Vulnerable components: admin JSF endpoints (applications.jsf, configuration.jsf, customMBeans.jsf, resourceNode/resources.jsf, sysnet/registration.jsf, webService/webServicesGeneral.jsf) and na...

GlassFish Enterprise Server 2.1 - Admin Console resourceNoderesources.jsf URI Cross-Site Scripting

GlassFish Enterprise Server 2.1 - Admin Console resourceNoderesources.jsf URI Cross-Site Scripting source: https://www.securityfocus.com/bid/34824/info GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied...

Sun Glassfish Enterprise Server 2.1 XSS

Digital Security Research Group DSecRG Advisory DSECRG-09-034 Original advisory: http://dsecrg.com/pages/vul/show.php?id=134 Application: Sun Glassfish Enterprise Server Versions Affected: 2.1 Vendor URL: https://glassfish.dev.java.net/ Bug: Multiple Linked XSS vulnerabilities Exploits: YES...

GlassFish Enterprise Server 2.1 - Admin Console applicationsapplications.jsf URI Cross-Site Scripting

GlassFish Enterprise Server 2.1 - Admin Console applicationsapplications.jsf URI Cross-Site Scripting source: https://www.securityfocus.com/bid/34824/info GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied...

BlackBerry Enterprise Server MDS Connection Service XSS

The remote host is running the BlackBerry Enterprise Server MDS Connection Service. The installed version is affected by cross-site scripting vulnerabilities involving the 'customDate', 'interval', 'lastCustomInterval', 'lastIntervalLength', 'nextCustomInterval', 'nextIntervalLength', 'action',...

Cross site scripting

Cross-site scripting XSS vulnerability in the "Customize Statistics Page" admin/statistics/ConfigureStatistics in the MDS Connection Service in Research in Motion RIM BlackBerry Enterprise Server BES before 4.1.6 MR5 allows remote attackers to inject arbitrary web script or HTML via the 1...

CVE-2009-0307

Cross-site scripting XSS vulnerability in the "Customize Statistics Page" admin/statistics/ConfigureStatistics in the MDS Connection Service in Research in Motion RIM BlackBerry Enterprise Server BES before 4.1.6 MR5 allows remote attackers to inject arbitrary web script or HTML via the 1...

CVE-2009-0307

The CVE-2009-0307 issue affects BlackBerry Enterprise Server (BES) MDS Connection Service, specifically the admin/statistics/ConfigureStatistics page. The vulnerability is a cross-site scripting (XSS) flaw caused by insufficient input validation in multiple parameters (customDate, interval, lastC...

BlackBerry Enterprise Server < 4.1.6 MR5 XSS

Binary data 5000.prm...

BlackBerry Enterprise Server MDS连接服务跨站脚本漏洞

BUGTRAQ ID: 34573 CVE ID：CVE-2009-0307 CNCVE ID：CNCVE-20090307 BlackBerry Enterprise Server是一款BlackBerry企业解决方案中的一个组件。 BlackBerry Enterprise Server包含的MDS连接服务存在输入验证问题，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 提交畸形URL可触发此漏洞，目前没有详细漏洞细节提供。 Research In Motion Blackberry Enterprise Server 4.1.6 MR4 Research In Motion...

Blackberry Enterprise Server XSS

Blackberries Mobile Data Service Connection Service XSS...

Blackberry Mobile Data Service XSS

ERNW Security Advisory 01-2009 XSS in Blackberries Mobile Data Service Connection Service Author: Michael Thumann 1. Summary The Blackberry Mobile Data Service Connection is vulnerable to several XSS attacks in the "Customize Statistics Page". 2. CVSS V2 Base Score : 3.5 based on vendor rating 3...

BlackBerry Enterprise Server 4.04.1 - MDS Connection Service Cross-Site Scripting

BlackBerry Enterprise Server 4.04.1 - MDS Connection Service Cross-Site Scripting source: https://www.securityfocus.com/bid/34573/info BlackBerry Enterprise Server MDS Connection Service is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input. ...

BlackBerry Enterprise Server 4.0/4.1 - MDS Connection Service Cross-Site Scripting

source: https://www.securityfocus.com/bid/34573/info BlackBerry Enterprise Server MDS Connection Service is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browse...

CVE-2009-0115

The Device Mapper multipathing driver aka multipath-tools or device-mapper-multipath 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server SLES, Fedora, and possibly other operating systems, uses world-writable permissions for the socket file aka /var/run/multipathd.sock, which allows loc...

Novell NetStorage 2.0.1/3.1.5 - Multiple Remote Vulnerabilities

source: https://www.securityfocus.com/bid/34267/info Novell NetStorage is prone to the following remote vulnerabilities: - An information-disclosure vulnerability - A cross-site scripting vulnerability - A denial-of-service vulnerability Attackers can exploit these issues to obtain sensitive...

CVE-2009-0651

CVE-2009-0651 affects Symantec Veritas NetBackup Server/Enterprise Server 5.x, 6.0 (pre MP7 SP1) and 6.5 (pre 6.5.3.1). The issue is described as an unspecified vulnerability in the Veritas network daemon (vnetd) that could allow a remote attacker to execute arbitrary code via unknown vectors rel...

CVE-2009-0611

Multiple cross-site scripting XSS vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterprise Server 1.x allow remote attackers to inject arbitrary web script or HTML via 1 the siteloc parameter in a displayaddsite action, the site parameter in a 2 generalproperties o...