CVE-2006-3261: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Trend Micro Control Manager TMCM 3.5 allows remote attackers to inject arbitrary web script or HTML via the username field on the login page, which is not properly sanitized before being displayed in the error log...

Directory traversal

Directory traversal vulnerability in posts.php in SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and execute arbitrary files via ".." sequences in the language cookie, as demonstrated by by injecting the code into the glsession cookie of users.php, which is stored in error.log...

Apache Error Log Escape Sequence Injection

The target is running an Apache web server which allows for the injection of arbitrary escape sequences into its error logs. An attacker might use this vulnerability in an attempt to exploit similar vulnerabilities in terminal emulators. OpenVAS has determined the vulnerability exists only by...

beaXSS.txt

I. DESCRIPTION A cross-site scripting issue affects the display of error events in the 'View Error Log' feature of BEA WebLogic Administration console. II. AFFECTED PRODUCTS BEA WebLogic 8.1 SP4 and previous. III. HOW TO VERIFY 1. Make a HTTP request containing XSS code to a target Web server $...

CVE-2005-0040

Multiple cross-site scripting XSS vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the 1 register a new user page, 2 User-Agent, or 3 Username, which is not properly quoted before sending to the error log...

CVE-2005-0040

Multiple cross-site scripting XSS vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the 1 register a new user page, 2 User-Agent, or 3 Username, which is not properly quoted before sending to the error log...

CVE-2005-0040

DotNetNuke (DNN) before 3.0.12 is affected by multiple XSS vulnerabilities (CVE-2005-0040) that allow remote attackers to inject script via (1) the register-a-new-user page, (2) the User-Agent header, and (3) the Username field, due to improper quoting before logging. Affected versions are

CVE-2005-0040: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the 1 register a new user page, 2 User-Agent, or 3 Username, which is not properly quoted before sending to the error log...

CVE-2004-1606

Affected software: SalesLogix 6.1; vulnerable component: slxweb.dll. Description from CVE entries: remote attackers can cause a denial of service (application crash) by sending an invalid HTTP request, with potential leakage of sensitive information via the ErrorLogMsg cookie. The connected docum...

CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

DEBIAN-CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

security flaw

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

Mandrake Linux Security Advisory : cups (MDKSA-2004:116)

Chris Evans discovered numerous vulnerabilities in the xpdf package, which also effect software using embedded xpdf code : Multiple integer overflow issues affecting xpdf-2.0 and xpdf-3.0. Also programs like cups which have embedded versions of xpdf. These can result in writing an arbitrary byte ...

CVE-2003-0020

CVE-2003-0020 concerns Apache HTTP Server: the product does not filter terminal escape sequences from error logs, enabling potential insertion of escape sequences into terminal emulators vulnerable to such sequences. Connected documents show multiple related CVEs affecting different Apache branch...

Apache < 1.3.31 / 2.0.49 Error Log Escape Sequence Injection

Binary data 1221.prm...

PHP 3.0.x < 3.0.17 / 4.0.x < 4.0.3 Error Log Command Injection

Binary data 1480.prm...

Mandrake Linux Security Advisory : apache-mod_perl (MDKSA-2004:046-1)

Four security vulnerabilities were fixed with the 1.3.31 release of Apache. All of these issues have been backported and applied to the provided packages. Thanks to Ralf Engelschall of OpenPKG for providing the patches. Apache 1.3 prior to 1.3.30 did not filter terminal escape sequences from its...