CVE-2007-0791

Cross-site scripting XSS vulnerability in Atom feeds in Bugzilla 2.20.3, 2.22.1, and 2.23.3, and earlier versions down to 2.20.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-0791

CVE-2007-0791 is a cross-site scripting (XSS) vulnerability in Bugzilla’s Atom feeds affecting Bugzilla versions 2.20.3, 2.22.1, 2.23.3, and older releases back to 2.20.1. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors within Atom feeds. The conne...

CVE-2007-0791: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Atom feeds in Bugzilla 2.20.3, 2.22.1, and 2.23.3, and earlier versions down to 2.20.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-6919

Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with an img tag containing the script followed by an extra trailing "", which Sage modifies to close the img element before the malicious script...

GLSA-200610-09 : libmusicbrainz: Multiple buffer overflows

The remote host is affected by the vulnerability described in GLSA-200610-09 libmusicbrainz: Multiple buffer overflows Luigi Auriemma reported a possible buffer overflow in the MBHttp::Download function of lib/http.cpp as well as several possible buffer overflows in lib/rdfparse.c. Impact : A...

Debian DSA-944-1 : mantis - several vulnerabilities

Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-4238 Missing input sanitising allows remote attackers to inject arbitrary web script or HTML. -...

CORE-2006-0322: Multiple vulnerabilities in ICQ Toolbar 1.3 for Internet Explorer

Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Multiple vulnerabilities in ICQ Toolbar 1.3 for Internet Explorer Date Published: 2006-09-07 Last Update: 2006-09-06 Advisory ID: CORE-2006-0322 Bugtraq ID: None currently assigned CVE Name: None currently assign...

CVE-2006-0389

Cross-site scripting XSS vulnerability in Syndication Safari RSS in Mac OS X 10.4 through 10.4.5 allows remote attackers to execute arbitrary JavaScript via unspecified vectors involving RSS feeds...

CVE-2006-0389

CVE-2006-0389 describes a cross-site scripting (XSS) vulnerability in Syndication (Safari RSS) on Mac OS X 10.4 through 10.4.5. The flaw allows remote attackers to execute arbitrary JavaScript via unspecified vectors involving RSS feeds, in the context of the affected user’s browser. Affected pro...

CVE-2006-0389

Cross-site scripting XSS vulnerability in Syndication Safari RSS in Mac OS X 10.4 through 10.4.5 allows remote attackers to execute arbitrary JavaScript via unspecified vectors involving RSS feeds...

CVE-2006-0389: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Syndication Safari RSS in Mac OS X 10.4 through 10.4.5 allows remote attackers to execute arbitrary JavaScript via unspecified vectors involving RSS feeds...

DSA-944-1 mantis - several

Bulletin has no description...

CVE-2005-4523

CVE-2005-4523 affects Mantis (MantisBT) 1.0.0rc3 and earlier. Root cause: private bugs are disclosed via public RSS feeds, enabling remote attackers to obtain sensitive information. Impact: information disclosure of private bugs. Mitigation: upgrade to fixed Mantis versions as referenced in Debia...

CVE-2005-4523

Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obtain sensitive information...

CVE-2005-3883

CRLF injection vulnerability in the mbsendmail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds LF in the "To" address argument...

Fantastic News "category" SQL inj.

Fantastic News "category" SQL inj. Vuln. dicovered by : r0t Date: 25 nov. 2005 orginal advisory:http://pridels.blogspot.com/2005/11/fantastic-news-category-sql-inj.html Vendor:www.fscripts.com Product link:http://fscripts.com/free.php?id=1 affected version: 2.1.1 and prior Product description:...

Debian DSA-294-1 : gkrellm-newsticker - missing quoting, incomplete parser

Brian Campbell discovered two security-related problems in gkrellm-newsticker, a plugin for the gkrellm system monitor program, which provides a news ticker from RDF feeds. The Common Vulnerabilities and Exposures project identifies the following problems : CAN-2003-0205 It can launch a web brows...

Add a generic HTML cleaning service

This will be able to be used by all components that need to display untrusted HTML: including HTML attachments, RSS feeds, and the html-include macro...

Security problems in gkrellm-newsticker

Brian Campbell discovered two security-related problems in gkrellm-newsticker, a plugin for the gkrellm system monitor program, which provides a news ticker from RDF feeds. The following IDs were assigned: CAN-2003-0205 gkrellm-newsticker can launch a web browser of the user's choice when the...