SparkleBlog Journal.php HTML Injection Vulnerability =>v2.1 (all versions vulnerable)

SparkleBlog is prone to HTMl injection attacks. It is possible for a malicious SparkleBlog user to inject hostile HTML script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of SparkleBlog. SparkleBlog does not adequately...

CVE-2005-3103

Summary: CVE-2005-3103 is an XSS vulnerability in Movable Type prior to 3.2. The issue allows remote attackers to inject arbitrary web script or HTML via multiple form fields (title, category, body, extended body, excerpt) when creating new blog entries. The provided description notes it as a cro...

CVE-2004-2330

ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fields...

CVE-2005-2428

Lotus Domino R5/R6 WebMail with Generate HTML for all fields enabled can reveal sensitive data via names.nsf hidden fields. The connected nuclei template documents information disclosure: password hashes in HTTPPassword, password-change date in HTTPPasswordChangeDate, and client release in ClntBl...

CVE-2002-1868

Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields...

CVE-2003-1212

MaxWebPortal 1.30 allows remote attackers to perform unauthorized actions by modifying hidden form fields, such as the 1 news, 2 lock, or 3 allmem fields in the 'start new topic' HTML page...

CVE-2004-2058

CVE-2004-2058 affects ASPrunner 2.4, where a remote attacker can disclose sensitive information via (1) hidden form fields or (2) error messages. The core description in the CVE entry is that ASPRunner 2.4 allows information disclosure to unauthenticated remote actors. Connected documents corrobo...

CVE-2004-2058

ASPRunner 2.4 allows remote attackers to gain sensitive information via 1 hidden form fields or 2 error messages...

ASP.NET __VIEWSTATE crypto validation prone to replay attacks

Good morning, ASP.NET's extremely popular VIEWSTATE functionality provides an automatic, uniform method for storing current state of all webpage "controls" including form fields, database views, etc, so that user-entered data automagically persists and is populated across newly rendered HTML, and...

CVE-2004-2058

ASPRunner 2.4 allows remote attackers to gain sensitive information via 1 hidden form fields or 2 error messages...

CVE-2004-2330

ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fields...

Multiple Browsers - Tabbed Browsing

Multiple Browsers - Tabbed Browsing Test Your Browser Open the link below in a new tab, then try to type data into form fields on the CitiBank website. Open this Link in New Tab Result: Keystrokes you pressed on the CitiBank website. /textarea // milw0rm.com 2004-10-22...

Invision Power Board v1.3 Final Cross Site Scripting Vulnerabillity

Software: Invision Power Board Vendor: http://www.invisionboard.com/ Versions: U v1.3 Final Bug: Cross Site Scripting Vulnerabillity Risk: Medium Exploitation: Remote with browser Date: 29 Feb 2004 Author: Rafel Ivgi, The-Insider E-Mail: [email protected] Web: http://theinsider.deep-ice.com 1...

CVE-2003-1212

MaxWebPortal 1.30 allows remote attackers to perform unauthorized actions by modifying hidden form fields, such as the 1 news, 2 lock, or 3 allmem fields in the 'start new topic' HTML page...

Max Web Portal 1.30 - Multiple Vulnerabilities

Max Web Portal 1.30 - Multiple Vulnerabilities Max Web Portal Multiple Vulnerabilities Vendor: Max Web Portal Product: Max Web Portal Version: alertdocument.cookie Remember this vuln as I will later explain how it can be used to aide an attacker to compromise user and admin accounts. Hidden Form...

CVE-2002-1462

details2.php in OrganicPHP PHP-affiliate 1.0, and possibly later versions, allows remote attackers to modify information of other users by modifying certain hidden form fields...

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure (2)

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure 2 source: https://www.securityfocus.com/bid/6993/info Clients of TYPO3 systems may access potentially sensitive data that have been obfuscated through hidden form fields. This may aid in exploiting other known issues in the software...

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure (1)

source: https://www.securityfocus.com/bid/6993/info Clients of TYPO3 systems may access potentially sensitive data that have been obfuscated through hidden form fields. This may aid in exploiting other known issues in the software. !/usr/bin/perl use LWP::UserAgent; use HTTP::Request; use...

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure (1)

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure 1 source: https://www.securityfocus.com/bid/6993/info Clients of TYPO3 systems may access potentially sensitive data that have been obfuscated through hidden form fields. This may aid in exploiting other known issues in the software...

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure (2)

source: https://www.securityfocus.com/bid/6993/info Clients of TYPO3 systems may access potentially sensitive data that have been obfuscated through hidden form fields. This may aid in exploiting other known issues in the software. !/usr/bin/perl use strict; use Getopt::Std; use LWP::UserAgent; u...