Microsoft Windows Vista Feed Headlines Gadget vulnerability

Overview The Windows Vista Feed Headlines gadget contains a vulnerability that may allow and attacker to execute code. Description From Microsoft Security Bulletin MS07-048:Gadgets are mini-applications designed to provide the user with information or utilities. Windows Vista treats gadgets simil...

Microsoft Security Bulletin MS07-048 - Important Vulnerabilities in Windows Gadgets Could Allow Remote Code Execution (938123)

Microsoft Security Bulletin MS07-048 - Important Vulnerabilities in Windows Gadgets Could Allow Remote Code Execution 938123 Published: August 14, 2007 Version: 1.0 General Information Executive Summary This important security update resolves two privately reported vulnerabilities in addition to...

Cross site scripting

Cross-site scripting XSS vulnerability in Windows Vista Feed Headlines Gadget aka Sidebar RSS Feeds Gadget in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zo...

CVE-2007-3033

Cross-site scripting XSS vulnerability in Windows Vista Feed Headlines Gadget aka Sidebar RSS Feeds Gadget in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zo...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string...

CVE-2007-4104

Multiple cross-site scripting XSS vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string...

WordPress Feed Stats Plugin <= 2.3 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...

Reflected XSS Vulnerability in the Feed Builder

---- Input in the Feed Builder is not properly handled. Insert: code "alert'Gotcha!' code as the feed name title and you get url like this:...

Reflected XSS Vulnerability in the Feed Builder

---- Input in the Feed Builder is not properly handled. Insert: code "alert'Gotcha!' code as the feed name title and you get url like this:...

Reflected XSS Vulnerability in the Feed Builder

---- Input in the Feed Builder is not properly handled. Insert: code "alert'Gotcha!' code as the feed name title and you get url like this:...

[Full-disclosure] Apple Safari for Windows feed:// URL Denial of Service Vulnerability

Apple Safari for Windows feed:// URL Denial of Service Vulnerability Versions: Apple Safari For Windows 3 Beta Apple Safari for Windows is prone to a denial-of-service vulnerability because it fails to properly handle crafted feed:// link. Proof-of-Concept: . Link: feed:// Exploit: a...

Cross site scripting

Cross-site scripting XSS vulnerability in the Andy Frank Beatnik 1.0 extension for Firefox allows remote attackers to inject arbitrary web script or HTML via an RSS feed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-3110

Cross-site scripting XSS vulnerability in the Andy Frank Beatnik 1.0 extension for Firefox allows remote attackers to inject arbitrary web script or HTML via an RSS feed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-3110

Technical details for CVE-2007-3110 are not publicly available in the provided documents. Monitor for updates from official advisories; current records reiterate an XSS issue in the Beatnik 1.0 Firefox extension via RSS, without specifics.

CVE-2007-3110

Cross-site scripting XSS vulnerability in the Andy Frank Beatnik 1.0 extension for Firefox allows remote attackers to inject arbitrary web script or HTML via an RSS feed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Design/Logic Flaw

BitsCast 0.13.0 allows remote attackers to cause a denial of service application crash via an RSS 2.0 feed item with certain invalid strings in a pubDate element, as demonstrated by repeated "../A" or "A/../" patterns...

BitsCast 0.13.0 - invalid string Remote Denial of Service

BitsCast 0.13.0 - invalid string Remote Denial of Service BitsCast 0.13.0 Remote Denial of Service Credits: gbr Tested on Windows XP SP2 BitsCast crashes when receiving a RSS 2.0 feed item with a invalid string in sub-element 'pubDate'. '../A' x 8, 'A/../' x 8, and others. PoC: Test Remote DoS Po...

BitsCast 0.13.0 - invalid string Remote Denial of Service

BitsCast 0.13.0 Remote Denial of Service Credits: gbr Tested on Windows XP SP2 BitsCast crashes when receiving a RSS 2.0 feed item with a invalid string in sub-element 'pubDate'. '../A' x 8, 'A/../' x 8, and others. PoC: Test Remote DoS PoC ../A../A../A../A../A../A../A../A../A../A../A../A...

php CRLF injection

CRLF injection vulnerability in the ftpputcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands...

ext10-lfi.txt

ext 1.0 alpha1 feed-proxy.php Remote File Disclosure D.Script: http://yui-ext.com/deploy/ext-1.0-alpha1.zip Discovered by: Alkomandoz Hacker Homepage: http://www.asb-may.net - mohandko.com - sniper-sa.com - tryag.com V.Code In /examples/layout/feed-proxy.php...