PHPLinks 2.1.2 Add Site HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6632/info phpLinks is prone to HTML injection. phpLinks does not sufficiently sanitized HTML and script code supplied via form fields before displaying this data to administrative users. This issue exists in the 'add.php'...

PYSEC-2014-110

Multiple cross-site scripting XSS vulnerabilities in apps/common/templates/calculateformtitle.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a 1 tag or the 2 title of a source in a Staging folder, 3 Name field in a bootstrap setup, or Title fie...

WordPress SS Downloads Cross Site Scripting

Exploit Title : Wordpress SS Downloads Plugin Cross Site Scripting Exploit Author : ACC3SS Vendor Homepage : http://wordpress.org/plugins/ss-downloads/developers/ Software Link : http://downloads.wordpress.org/plugin/ss-downloads.1.4.4.1.zip Date : 2014-01-19 Tested on : Windows 7 / Mozilla Firef...

CVE-2013-5227

Apple Safari before 6.1.1 and 7.x before 7.0.1 allows remote attackers to bypass the Same Origin Policy and discover credentials by triggering autofill of subframe form fields...

CVE-2013-5227

CVE-2013-5227 (Safari autofill origin tracking) affects Apple Safari, where remote attackers could bypass Same Origin Policy and discover credentials by triggering autofill of subframe form fields. The vulnerability is described as: Safari may autofill user names and passwords into a subframe fro...

CVE-2013-5227

Apple Safari before 6.1.1 and 7.x before 7.0.1 allows remote attackers to bypass the Same Origin Policy and discover credentials by triggering autofill of subframe form fields...

CVE-2013-5227: Undefined Security Weakness

Apple Safari before 6.1.1 and 7.x before 7.0.1 allows remote attackers to bypass the Same Origin Policy and discover credentials by triggering autofill of subframe form fields...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and earlier allow 1 remote attackers to inject arbitrary web script or HTML via the username parameter in a login or 2 remote authenticated users to inject arbitrary web script or HTML vi...

CVE-2013-3471: Undefined Security Weakness

The captive portal application in Cisco Identity Services Engine ISE allows remote attackers to discover cleartext usernames and passwords by leveraging unspecified use of hidden form fields in an HTML document, aka Bug ID CSCug02515...

http-rfi-spider NSE Script

Crawls webservers in search of RFI remote file inclusion vulnerabilities. It tests every form field it finds and every parameter of a URL containing a query. Script Arguments http-rfi-spider.withinhost only spider URLs within the same host. default: true http-rfi-spider.url the url to start...

CVE-2012-0676: Improper Input Validation

WebKit in Apple Safari before 5.1.7 does not properly track state information during the processing of form input, which allows remote attackers to fill in form fields on the pages of arbitrary web sites via unspecified vectors...

CVE-2010-4580

Opera before 11.00 does not clear WAP WML form fields after manual navigation to a new web site, which allows remote attackers to obtain sensitive information via an input field that has the same name as an input field on a previously visited web site...

CVE-2010-4580: Exposure of Sensitive Information to an Unauthorized Actor

Opera before 11.00 does not clear WAP WML form fields after manual navigation to a new web site, which allows remote attackers to obtain sensitive information via an input field that has the same name as an input field on a previously visited web site...

HTTP Form Field Fuzzer

This module will grab all fields from a form, and launch a series of POST actions, fuzzing the contents of the form fields. You can optionally fuzz headers too option is enabled by default This module requires Metasploit: https://metasploit.com/download Current source:...

Researchers To Debut Botnet-Resistant Coding Techniques

As the botnet epidemic continues to rage, researchers are expanding the scope of their search for new methods to prevent users from becoming unwitting victims of these massive malicious networks. One pair of researchers this week will unveil a new technique they’ve developed to help Web sites...

b2evolution 3.3.3 - Cross-Site Request Forgery

---------------------------------------------------------------------------- : Exploit Title: b2evolution 3.3.3 Cross site request forgery : : Date: 05/07/2010 & 23/07/1431 H : : Author: saudi0hacker : : Software Link: http://b2evolution.net/downloads/index.html : : Version: 3.3.3 : : Tested on:...

DEBIAN-CVE-2009-3581

Multiple cross-site scripting XSS vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via 1 the DCN Description field in the Accounts Receivables menu item for Add Transaction, 2 the Description field in the Accounts Payable menu item for A...

CVE-2009-3370

Mozilla Firefox before 3.0.15, and 3.5.x before 3.5.4, allows remote attackers to read form history by forging mouse and keyboard events that leverage the auto-fill feature to populate form fields, in an attacker-readable form, with history entries...

Design/Logic Flaw

Mozilla Firefox before 3.0.15, and 3.5.x before 3.5.4, allows remote attackers to read form history by forging mouse and keyboard events that leverage the auto-fill feature to populate form fields, in an attacker-readable form, with history entries...

CVE-2009-3370

Mozilla Firefox before 3.0.15, and 3.5.x before 3.5.4, allows remote attackers to read form history by forging mouse and keyboard events that leverage the auto-fill feature to populate form fields, in an attacker-readable form, with history entries...