Virtual Hosting Control System 2.2/2.4 - Error Message Cross-Site Scripting

source: https://www.securityfocus.com/bid/15538/info Virtual Hosting Control System is prone to cross-site scripting attacks. The vulnerability arises when error messages are rendered and could let an attacker inject hostile HTML and script code into the browser session of another user in the...

CVE-2005-3570

Unspecified cross-site scripting XSS vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML via "not properly escaped error messages"...

CVE-2005-3570

Unspecified cross-site scripting XSS vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML via "not properly escaped error messages"...

Inicom networks ioFTPd FTP Server account enumeration

Error messages differ for existant and non-existant user account...

CVE-2004-2505

Macromedia ColdFusion MX before 6.1 does not restrict the size of error messages, which allows remote attackers to cause a denial of service memory consumption and crash by sending repeated GET or POST requests that trigger error messages that use long strings of data...

CVE-2005-3076

Simplog 0.9.1 might allow remote attackers to execute arbitrary SQL commands or trigger SQL error messages via invalid 1 pid, 2 blogid, 3 cid, or 4 m parameters to archive.php, or the 5 blogid parameter to blogadmin.php...

CVE-2005-3017

The CVE-2005-3017 entry concerns a PHP file inclusion vulnerability in Content2Web 1.0.1. A remote attacker can influence the show parameter in index.php to include arbitrary files, with resulting errors that can disclose paths, trigger SQL errors, and enable cross-site scripting (XSS). This vuln...

CVE-2005-3017

PHP file inclusion vulnerability in index.php in Content2Web 1.0.1 allows remote attackers to include arbitrary files via the show parameter, which can lead to resultant errors such as path disclosure, SQL error messages, and cross-site scripting XSS...

Fedora Core 2 : postgresql-7.4.7-3.FC2.1 (2005-158)

Mon Feb 21 2005 Tom Lane 7.4.7-3.FC2.1 - Repair improper error message in init script when PGVERSION doesn't match. - Arrange for auto update of version embedded in init script. - Fix improper call of strerrorr, which leads to junk error messages in libpq. - Patch additional buffer overruns in...

Fedora Core 3 : squid-2.5.STABLE9-1.FC3.4 (2005-276)

Wed Mar 23 2005 Jay Fenlason 7:2.5.STABLE9-1.FC3.4 - Add more upstream patches. - add the -libbind patch, to avoid picking up a new dependency on libbind. - Remove references to /etc/squid/errors from this spec, since squid now uses datadir/squid/errors/English/ by default overridable in...

CVE-2004-2313

Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts such as root, which allows remote attackers to guess the root password via brute force attacks...

NetworkActiv Web Server Cross-Site Scripting

Crossite scripting with error messages on requests like http://host/?"code...

CVE-2001-1528

The CVE-2001-1528 entry concerns AmTote International homebet software. It describes a vulnerability where the authentication process reveals different error messages for invalid account numbers and PINs, enabling remote attackers to brute-force and determine the existence of valid accounts. Affe...

CVE-2002-2024

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for 1 poppassd.php3, 2 login.php3?reason=chpass2, 3 spelling.php3, and 4 ldap.search.php3?ldapserv=nonsense which leaks the information in error messages...

CVE-2002-2024

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for 1 poppassd.php3, 2 login.php3?reason=chpass2, 3 spelling.php3, and 4 ldap.search.php3?ldapserv=nonsense which leaks the information in error messages...

CVE-2002-2007

The CVE-2002-2007 vulnerability affects Apache Tomcat 3.2.3 and 3.2.4, where remote attackers could obtain sensitive information (directory listings and web root path) via erroneous HTTP requests to JSP-related paths (test/jsp, samples/jsp, examples/jsp) or the test/realPath.jsp servlet, leaking ...

CVE-2001-1528

AmTote International homebet program returns different error messages when invalid account numbers and PIN codes are provided, which allows remote attackers to determine the existence of valid account numbers via a brute force attack...

CVE-2005-2110

WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via 1 a direct request to menu-header.php or a "1" value in the feed parameter to 2 wp-atom.php, 3 wp-rss.php, or 4 wp-rss2.php, which reveal the path in an error message. NOTE: vector 1 was later reported to al...

CVE-2004-2150

Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names...

CVE-2002-1837

The CVE-2002-1837 vulnerability affects Image Display System (IDS) 0.81 and is triggered by getAlbumToDisplay in idsShared.pm, where using .. in the album parameter enables remote attackers to verify the existence of arbitrary directories, evidenced by different error messages depending on whethe...