Script injection in feed preview can reveal contents of unrelated news feeds

When Opera is previewing a news feed, some scripted URLs are not correctly blocked. These can execute scripts which are able to subscribe the user to any feed URL that the attacker chooses, and can also view the contents of any feeds that the user is subscribed to. These may contain sensitive...

Feed CMS 1.07.03.19b Local File Inclusion

Feed Cms 1.07.03.19 Beta LFI Autore: x0r Email: [email protected] Download: http://heanet.dl.sourceforge.net/sourceforge/feedcms/FeedCms1.07.03.19Beta.rar Bug In: index.php if $GET'lang' $language = $GET'lang'; setcookie'firstlang',$language,time+3600240365; header'location:'.$redirect; $lang ...

Feed Cms 1.07.03.19b (lang) Local File Inclusion Vulnerability

No description provided by source. Feed Cms 1.07.03.19 Beta LFI Autore: x0r Email: [email protected] Download: http://heanet.dl.sourceforge.net/sourceforge/feedcms/FeedCms1.07.03.19Beta.rar Bug In: index.php if $GET'lang' $language = $GET'lang'; setcookie'firstlang',$language,time+3600240365;...

Feed CMS 1.07.03.19b - 'lang' Local File Inclusion

Feed Cms 1.07.03.19 Beta LFI Autore: x0r Email: [email protected] Download: http://heanet.dl.sourceforge.net/sourceforge/feedcms/FeedCms1.07.03.19Beta.rar Bug In: index.php if $GET'lang' $language = $GET'lang'; setcookie'firstlang',$language,time+3600240365; header'location:'.$redirect; $lang ...

Feed CMS 1.07.03.19b - lang Local File Inclusion

Feed CMS 1.07.03.19b - lang Local File Inclusion Feed Cms 1.07.03.19 Beta LFI Autore: x0r Email: [email protected] Download: http://heanet.dl.sourceforge.net/sourceforge/feedcms/FeedCms1.07.03.19Beta.rar Bug In: index.php if $GET'lang' $language = $GET'lang';...

Feed Cms 1.07.03.19b (lang) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ============================================================== Feed Cms 1.07.03.19b lang Local File Inclusion Vulnerability ============================================================== Feed Cms 1.07.03.19 Beta LFI Autore: x0r Download:...

Fedora 8 : cups-1.3.9-2.fc8 (2008-10911)

Security update to fix CVE-2008-5183. Also included is a fix for incorrect form-feed handling in the textonly filter. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and forma...

WordPress wp-includes/feed.php self_link() Function Host Header RSS Feed XSS

The version of WordPress installed on the remote host fails to properly sanitize input to the 'Host' request header before using it in the 'selflink' function in 'wp-includes/feed.php' to generate dynamic HTML output. An attacker can leverage this issue to inject arbitrary HTML and script code in...

FreeBSD : wordpress -- header rss feed script insertion vulnerability (622bc638-be27-11dd-a578-0030843d3802)

Secunia reports : Input passed via the HTTP 'Host' header is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site if malicious data is viewed. %NASLMINLEVEL 70300 C Tenable Network...

CVE-2008-5278

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

Cross site scripting

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

CVE-2008-5278

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

DEBIAN-CVE-2008-5278

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

CVE-2008-5278

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

CVE-2008-5278

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

CVE-2008-5278

WordPress CVE-2008-5278 affects the RSS Feed Generator (wp-includes/feed.php) prior to 2.6.5, enabling remote injection of HTML/script via HTTP_HOST. The issue is caused by unsanitized Host header, resulting in XSS in the RSS feed. Remediation: upgrade WordPress to 2.6.5 or later (per the descrip...

CVE-2008-5278

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

WordPress RSS Feed Generator Plugin <= 2.6.4 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the Host header. Solution Update the plugin...

wordpress -- header rss feed script insertion vulnerability

Secunia reports: Input passed via the HTTP "Host" header is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site if malicious data is viewed...

opera -- multiple vulnerabilities

The Opera Team reports: Manipulating certain text-area contents can cause a buffer overflow, which may be exploited to execute arbitrary code. Certain HTML constructs can cause the resulting DOM to change unexpectedly, which triggers a crash. To inject code, additional techniques will have to be...