Microsoft Windows XP - 'explorer.exe' Remote Denial of Service

source: https://www.securityfocus.com/bid/9924/info Microsoft Windows Explorer for Windows XP has been reported to be prone to a remote denial of service vulnerability. This issue is due to a failure of the application to properly validate user-supplied input via the 'shell:' command. The 'shell:...

Invision Board spoof and defacement

-INTRO- All versions of Invisions Board have a flaw in their input filtering that allows an attacker to completely mess up Invision's display and in one case I managed to change the URL of some of the forums links, which could be used to refer users to fake login sites to collect passwords etc...

CVE-2003-0283

Cross-site scripting XSS vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a "" before a tag name in the 1 subject, 2 author's name, or 3 author's e-mail...

A Phorum's bug...

Hi! I have founded a bug in Phorum http://phorum.org/. It is possible to inject script code or other html-tag into "subject", "author's name" or "author's e-mail" of a message in Phorum. In the subject name, e-mail input of message you need to write any html-tag like this:...

Onecenter Forum 4.0 - IMG Tag Script Injection

Onecenter Forum 4.0 - IMG Tag Script Injection source: https://www.securityfocus.com/bid/7441/info OneCenter ForumOne 4.0 is a full-featured, web-based group discussion forum. A problem with Onecenter ForumOne could allow remote users to execute arbitrary code in the context of the web site hosti...

CVE-2002-1348

w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies...

CVE-2002-1348

w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies...

CVE-2002-2424

Cross-site scripting XSS vulnerability in PHPReactor 1.2.7 pl1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the style attribute of an HTML tag...

Input Validation Error in vbulletin 2.2.x

Description: --------------- VBulletin discussion forum http://www.vbulletin.com does not properly validate the input for html tag enabled forums, allowing arbitrary JavaScript code to be run for any access level user. Prof of concept: ---------------- b onMouseOver="alertdocument.location;"This...

CVE-2002-1335

Cross-site scripting XSS vulnerability in w3m 0.3.2 does not escape an HTML tag in a frame, which allows remote attackers to insert arbitrary web script or HTML and access files or cookies...

CVE-2002-1335

Cross-site scripting XSS vulnerability in w3m 0.3.2 does not escape an HTML tag in a frame, which allows remote attackers to insert arbitrary web script or HTML and access files or cookies...

CVE-2002-1335

Cross-site scripting XSS vulnerability in w3m 0.3.2 does not escape an HTML tag in a frame, which allows remote attackers to insert arbitrary web script or HTML and access files or cookies...

vBulletin 2.02.2.x - Cross-Site Scripting

vBulletin 2.02.2.x - Cross-Site Scripting source: https://www.securityfocus.com/bid/5997/info vBulletin does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks. As a result, it is possible for a remote attacker to create a malicious link containing script co...

Teekai Tracking Online 1.0 - Cross-Site Scripting

Teekai Tracking Online 1.0 - Cross-Site Scripting source: https://www.securityfocus.com/bid/4924/info Teekai's Tracking Online does not adequately filter HTML tags from certain URL parameters, making it prone to cross-site scripting attacks. Attackers may exploit this by creating a malicious link...

ViewCVS 0.9.2 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/4818/info ViewCVS does not filter HTML tags from certain URL parameters, making it prone to cross-site scripting attacks. An attacker may exploit this by constructing a malicious link with script code to a site running ViewCVS and sending it to a legitima...

Microsoft Internet Information Server (IIS) contains cross-site scripting vulnerability in HTTP error page results

Overview Visitors to web sites that use Microsoft IIS and also use the default error pages are vulnerable to cross-site scripting attacks. Description Cross-site scripting is a form of attack in which an intruder leverages the trust between a victim and a web-site the victim trusts. Quoting from...

Microsoft Internet Information Server (IIS) contains cross-site scripting vulnerability in IIS Help Files search facility

Overview Visitors to web sites that use Microsoft IIS 5.0 and 5.1 are vulnerable to cross-site scripting attacks through the IIS help facility. Description Cross-site scripting is a form of attack in which an intruder leverages the trust between a victim and a web-site the victim trusts. Quoting...

CVE-1999-1531

CVE-1999-1531 documents a buffer overflow in IBM HomePagePrint 1.0.7 for Windows98J triggered by a long IMG_SRC HTML tag, allowing a malicious Web site to execute arbitrary code on a viewer’s system. The vulnerability affects the viewer’s environment via HTML rendering input, with a network-based...

CVE-2001-0835

Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attackers to inject arbitrary HTML tags by specifying them in 1 search keywords embedded in HTTP referrer information, or 2 host names that are retrieved via a reverse DNS lookup...

Aladdin Knowledge Systems eSafe Gateway 3.0 - HTML tag Script-filtering Bypass

Aladdin Knowledge Systems eSafe Gateway 3.0 - HTML tag Script-filtering Bypass source: https://www.securityfocus.com/bid/2800/info eSafe Gateway is a security utility used for filtering internet content. It is possible to craft an html file that slips through eSafe Gateway's script filtering...