[Full-disclosure] iDefense Security Advisory 04.08.08: Microsoft HxTocCtrl ActiveX Control Invalid Param Heap Corruption Vulnerability

iDefense Security Advisory 04.08.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 08, 2008 I. BACKGROUND The HxTocCtrl ActiveX Control is a library used by the Microsoft Help engine. More information is available at the following website. http://en.wikipedia.org/wiki/MicrosoftHelp2 I...

[SECURITY] Fedora 7 Update: yelp-2.18.1-10.fc7

Yelp is the Gnome 2 help/documentation browser. It is designed to help you browse all the documentation on your system in one central tool...

Hardcoded credentials

Help Viewer in Apple Mac OS X 10.4.11 and 10.5.2 allows remote attackers to execute arbitrary Applescript via a help:topiclist URL that injects HTML or JavaScript into a topic list page, as demonstrated using a help:runscript link...

CVE-2008-0060

Help Viewer in Apple Mac OS X 10.4.11 and 10.5.2 allows remote attackers to execute arbitrary Applescript via a help:topiclist URL that injects HTML or JavaScript into a topic list page, as demonstrated using a help:runscript link...

CVE-2008-1347

Multiple cross-site scripting XSS vulnerabilities in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 the q parameter in an about action to the help system...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 the q parameter in an about action to the help system...

CVE-2008-1347

Multiple cross-site scripting XSS vulnerabilities in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 the q parameter in an about action to the help system...

CVE-2008-1204

Multiple cross-site scripting XSS vulnerabilities in the Administration Console in Sun Java System Access Manager 7.1 and 7 2005Q4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the 1 Help and 2 Version windows...

CVE-2008-1183

Multiple cross-site scripting XSS vulnerabilities in Crafty Syntax Live Help CSLH before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 livehelp.php, 2 userquestions.php, and 3 leavemessage.php. NOTE: the lostsheep.php vector is covered by...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Crafty Syntax Live Help CSLH before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 livehelp.php, 2 userquestions.php, and 3 leavemessage.php. NOTE: the lostsheep.php vector is covered by...

CVE-2008-1183

Multiple cross-site scripting XSS vulnerabilities in Crafty Syntax Live Help CSLH before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 livehelp.php, 2 userquestions.php, and 3 leavemessage.php. NOTE: the lostsheep.php vector is covered by...

CVE-2008-1183

CVE-2008-1183 documents multiple cross-site scripting (XSS) vulnerabilities in Crafty Syntax Live Help (CSLH) prior to 2.14.6. The affected components are the web endpoints (livehelp.php, user_questions.php, leavemessage.php) where unspecified parameters can be exploited to inject script/HTML. Th...

CVE-2008-0848

Cross-site scripting XSS vulnerability in lostsheep.php in Crafty Syntax Live Help CSLH before 2.14.16, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the versions claimed by the original researcher are probably incorrect...

Cross site scripting

Cross-site scripting XSS vulnerability in lostsheep.php in Crafty Syntax Live Help CSLH before 2.14.16, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the versions claimed by the original researcher are probably incorrect...

CVE-2008-0848

Cross-site scripting XSS vulnerability in lostsheep.php in Crafty Syntax Live Help CSLH before 2.14.16, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the versions claimed by the original researcher are probably incorrect...

CVE-2008-0848

Crafty Syntax Live Help (CSLH) is affected by CVE-2008-0848 due to an XSS vulnerability in lostsheep.php present in versions before 2.14.16. The entry states remote attackers can inject arbitrary script or HTML via unspecified vectors. The notes mention possible inaccuracies in the researcher’s v...

Crafty Syntax Xss Vulnerability

Crafty Syntax Live Help is an open source help desk system built mainly for small-mid sized companies. The software includes an xss vulnerability on lostsheep.php module. Versions effected: 2.4.13 - 2.4.14 -- Ozgur Ozdemircili CCNA, HIPAA, OPSEC, Open Source Security Systems...

PHP Live! 3.2.2 - 'questid' SQL Injection (1)

!Info! PHP Live! © OSI Codes Inc. enables live help and live customer support communication directly from your website. With PHP Live!, you can provide one-on-one chat assistance in real-time, answer visitor questions and add that extra human touch to your website. !SQL Injection! Code:...

A-Blog 2.0 - Cross-Site Scripting SQL Injection

A-Blog 2.0 - Cross-Site Scripting SQL Injection !/usr/bin/perl A-Blog V.2 Multiple Remote Vulnerabilities SQL Injection Exploit/XSS AUTHOR : IRCRASH Discovered by : Dr.Crash Exploited By : Dr.Crash IRCRASH Team Members : Dr.Crash - Malc0de - R3d.w0rm Script Download :...

[waraxe-2008-SA#063] - Information Leakage in Kayako SupportSuite 3.11.01

waraxe-2008-SA063 - Information Leakage in Kayako SupportSuite 3.11.01 =============================================================================== Author: Janek Vind "waraxe" Date: 21. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-63.html Target software description...