CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

Debian CVE•added 2007/10/30 7:0 p.m.•13 views

CVE-2007-5712

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

2.6CVSS6.2AI score0.01815EPSS

seebug.org•added 2007/10/28 12:0 a.m.•16 views

Phpbasic basicFramework Includes.PHP远程文件包含漏洞

Phpbasic basicFramework是一款基于PHP的WEB应用程序。 Phpbasic basicFramework不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。问题是由于'includes.php'脚本对用户提交的'root'参数缺少过滤，指定远程服务器上的任意文件作为包含参数，可导致以WEB权限执行任意PHP代码。 phpbasic.com basicFramework 1.0 目前没有详细解决方案提供： http://fw.phpbasic.com/?basic=topic&id=1...

7.1AI score

0day.today•added 2007/09/03 12:0 a.m.•57 views

CCProxy <= v6.2 Telnet Proxy Ping Overflow Exploit (meta)

Exploit for unknown platform in category remote exploits ========================================================= CCProxy 'CCProxy %q This module exploits the YoungZSoft CCProxy 'Patrick Webster ' , 'Arch' = ARCHX86 , 'License' = MSFLICENSE, 'Version' = '$Revision$', 'References' = 'BID', '11666...

7.1AI score0.75321EPSS

Exploits8

Packet Storm•added 2007/07/10 12:0 a.m.•30 views

codeigniter-multi.txt

CodeIgniter is a powerful PHP framework with a very small footprint, built for PHP coders who need a simple and elegant toolkit to create full-featured web applications. http://www.codeigniter.com 1. sanitizeglobals global variables unsetting By setting e.g. "SERVER=anonymous" cookie in the...

7.4AI score

Exploit DB•added 2007/06/14 12:0 a.m.•32 views

Apache MyFaces Tomahawk JSF Framework 1.1.5 - 'Autoscroll' Cross-Site Scripting

source: https://www.securityfocus.com/bid/24480/info Apache Tomahawk MyFaces JSF Framework is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to launch cross-site scripting attacks on...

7.4AI score

0day.today•added 2007/06/04 12:0 a.m.•20 views

SNMPc <= 7.0.18 Remote Denial of Service Exploit (meta)

Exploit for unknown platform in category dos / poc ======================================================= SNMPc 'SNMPc ', 'Description' = %q This module sends a specially-crafted packet to the service login of snmpc causing a denial of service of snmpc. , 'Author' = 'En Douli, Tks to OaiTeam ' ,...

7AI score

OSV•added 2007/05/15 12:0 a.m.•17 views

DSA-1292-1 qt4-x11

Bulletin has no description...

4.3CVSS6.3AI score0.02172EPSS

NVD•added 2007/04/30 11:19 p.m.•13 views

CVE-2007-2381

The MochiKit framework exchanges data using JavaScript Object Notation JSON without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other...

CVE•added 2007/04/30 11:0 p.m.•51 views

Exploits0References2

CVE-2007-2376

The CVE-2007-2376 entry describes a vulnerability in the Dojo framework where data is exchanged in JSON without a protective scheme, allowing remote attackers to exfiltrate data by loading a URL in the SRC attribute of a SCRIPT element and then reading it with other JavaScript. This results in pa...

CVE•added 2007/04/30 11:0 p.m.•84 views

CVE-2007-2378

The CVE-2007-2378 issue concerns the Google Web Toolkit (GWT) framework, where JSON data is exchanged without a protection scheme, enabling JavaScript Hijacking. IBM’s bulletin specifies ITNM (IBM Tivoli Network Manager) IP Edition 4.2 GA through 4.2.0.15 is affected, with a fix in ITNM 4.2 Fix P...

5CVSS6.5AI score0.00268EPSS

CVE•added 2007/04/30 11:0 p.m.•327 views

CVE-2007-2379

CVE-2007-2379 affects the jQuery framework, where data is exchanged as JSON without an associated protection scheme. This enables JavaScript Hijacking: a remote attacker can obtain data by a page that retrieves it through a URL in the SRC attribute of a SCRIPT element and reads it with other Java...

5CVSS6.5AI score0.01367EPSS

Exploits0References3Affected Software1

CVE•added 2007/04/30 11:0 p.m.•46 views

CVE-2007-2380

The CVE-2007-2380 issue affects the Microsoft Atlas framework, where JSON data is exchanged without an associated protection scheme, enabling JavaScript Hijacking. Affected component is the Atlas JSON data exchange; root cause is lack of protection in JSON data retrieved via a SCRIPT element SRC ...

5CVSS6.4AI score0.21372EPSS

CVE•added 2007/04/30 11:0 p.m.•44 views

CVE-2007-2381

The CVE-2007-2381 issue concerns the MochiKit framework. Affected component: MochiKit’s data exchange using JSON without an accompanying protection scheme. Root cause: data can be obtained by exploiting a page that fetches the JSON via a SCRIPT element’s SRC URL and related JavaScript, i.e., Java...

CVE•added 2007/04/30 11:0 p.m.•40 views

CVE-2007-2382

The CVE-2007-2382 entry concerns the Moo.fx framework, where data is exchanged in JSON without an associated protection scheme. The underlying issue is exposed via JavaScript Hijacking: a malicious page can retrieve data by loading a URL in the SRC attribute of a SCRIPT element and capturing it w...

CVE•added 2007/04/30 11:0 p.m.•86 views

CVE-2007-2383

CVE-2007-2383 affects the Prototype.js framework prior to 1.5.1 RC3, which exposes JSON data via a SCRIPT SRC URL and allows data exfiltration via JavaScript Hijacking. Public connected documents confirm the vulnerability vector and mention the affected library version. The provided sources do no...

5CVSS6.2AI score0.00262EPSS

Exploits0References5Affected Software1

CVE•added 2007/04/30 11:0 p.m.•70 views

CVE-2007-2385

The set of connected records confirms a JavaScript Hijacking vulnerability in the Yahoo! UI framework. Affected component: Yahoo! UI framework; vulnerability arises from exchanging data in JSON without an associated protection scheme, allowing a remote attacker to obtain data when a web page load...

5CVSS6.5AI score0.00773EPSS