Mozilla Foundation Security Advisory 2010-83

Mozilla Foundation Security Advisory 2010-83 Title: Location bar SSL spoofing using network error page Impact: High Announced: December 9, 2010 Reporter: Michal Zalewski Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.13 Firefox 3.5.16 SeaMonkey 2.0.11 Description Google security researcher...

Unvalidated input on error page.

PMASA-2010-9 Announcement-ID: PMASA-2010-9 Date: 2010-12-07 Updated: 2010-02-16 Summary Unvalidated input on error page. Description It was possible to display arbitrary text and link to external site using parameters passed to particular script. Severity This issue is considered minor, because t...

phpMyAdmin - Client-Side Code Injection Redirect Link Falsification

phpMyAdmin - Client-Side Code Injection Redirect Link Falsification PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification Credits: Emanuele 'emgent' Gentili Marco 'whitesheep' Rondini Alessandro 'scox' Scoscia In error.php, PhpMyAdmin permit to insert text and restricted tag,...

Cross site scripting

Opera before 10.63 does not properly select the security context of JavaScript code associated with an error page, which allows user-assisted remote attackers to conduct cross-site scripting XSS attacks via a crafted web site...

CVE-2010-4047

Opera before 10.63 is affected by a vulnerability where the security context of JavaScript on the error page is not correctly enforced, enabling user‑assisted remote XSS via a crafted site. Affected component: Opera browser (pre-10.63). Underlying cause: improper security context handling for err...

PT-2010-5263

Name of the Vulnerable Software and Affected Versions Opera versions prior to 10.63 Description The issue allows user-assisted remote attackers to conduct cross-site scripting XSS attacks via a crafted web site, due to improper selection of the security context of JavaScript code associated with ...

CVE-2010-4047: Improper Neutralization of Input During Web Page Generation

Opera before 10.63 does not properly select the security context of JavaScript code associated with an error page, which allows user-assisted remote attackers to conduct cross-site scripting XSS attacks via a crafted web site...

JavaScript might run in the wrong context if loaded from error page

If Opera is sent to an invalid URL, an error page will be displayed along with a link to the URL. The URL linked to might run scripts, and in some cases these scripts might be run in the wrong security context. This can be used to execute scripts in the context of an unrelated domain, which allow...

JavaScript might run in the wrong context if loaded from error page – Opera Security Advisories

JavaScript might run in the wrong context if loaded from error page – Opera Security Advisories OPCOM Team | October 11, 2010 Severity Moderate Description If Opera is sent to an invalid URL, an error page will be displayed along with a link to the URL. The URL linked to might run scripts, and in...

rekonq 'Error Page' Cross-Site Scripting Vulnerabilities

This host is installed with rekonq and is prone to cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbrekonqmultxssvuln.nasl 4919 2017-01-02 15:22:45Z cfi $ rekonq 'Error Page' Cross-Site Scripting Vulnerabilities. Authors: Madhuri D Copyright: Copyright c 2010 Greenbone...

rekonq < 0.6 'Error Page' XSS Vulnerabilities

rekonq is prone to cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-0541

Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...

Cross site scripting

Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...

CVE-2010-0541

Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...

CVE-2010-0541: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...

风讯(FoosunCMS) 5.0 Error.asp 错误页跨站脚本漏洞

北洋贱队http://bbs.seceye.org首发 FoosunCMS是一款具有强大的功能的基于ASP+ACCESS/MSSQL构架的内容管理软件，国内领先的第一款开源的、集成web2.0元素的、模块化的ＣＭＳ建站系统。 FoosunCMS不正确过滤用户输入，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 由于不正确处理错误页面，在返回给用户后，可导致恶意脚本代码在目标浏览器上执行，泄漏敏感信息。 风讯FoosunCMS 5.0 用户可联系官方获得最新版本...

Joomla VirtueMart Module (Customers_who_bought...) SQL Injection

Exploit for unknown platform in category web applications ============================================================================== Joomla VirtueMart Module Customerswhobought... SQL Injection Vulnerability ============================================================================== ...BEG...

Microsoft IIS 5.1 重定向错误页面跨站脚本执行漏洞

No description provided by source...

CVE-2009-4157: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in the ProofReader comproofreader component 1.0 RC9 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in 1 404 or 2 error pages...

Apache Tomcat 3.2.1 - 404 Error Page Cross-Site Scripting

Apache Tomcat is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to...