usd250 helpdesk XSS vulnerabily.

http://www.oneorzero.com/ Within the helpdesk utility usd250, an XSS in the comments field is possible. The comments strip script tags and replace them with not allowed, but script tags dont need to be in place for XSS. Something along the lines of... b onmouseover="window.alert'omghax'"some text...

Insanely simple blog - Multiple vulnerabilities

Insanely simple blog version 0.5 and below http://sourceforge.net/projects/insanelysimple2 ISB contains multple vulnerabilities including both XSS, and SQL injection. First off, the search action fails to strip user content for html allowing a user to input tags. Next, anonymous blog entries can...

isb05-sql.txt

Insanely simple blog version 0.5 and below http://sourceforge.net/projects/insanelysimple2 ISB contains multple vulnerabilities including both XSS, and SQL injection. First off, the search action fails to strip user content for html allowing a user to input tags. Next, anonymous blog entries can...

CVE-2006-2219

phpBB 2.0.20 does not verify user-specified input variable types before being passed to type-dependent functions, which allows remote attackers to obtain sensitive information, as demonstrated by the 1 mode parameter to memberlist.php and the 2 highlight parameter to viewtopic.php that are used a...

PHP buffer overflow

Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the 1 htmlentities or 2 htmlspecialchars functions...

TorrentFlux 2.2 - 'maketorrent.php' Remote Command Execution

The variable announce in maketorrent.php is not sanitised before being used. The announce variable goes through various stages throughout the script, then it is passed as a into an exec function. This occurs in the middle of the string which is passed to the exec function. Therefore it is possibl...

TorrentFlux 2.2 (maketorrent.php) Remote Command Execution Exploit

No description provided by source. The variable announce in maketorrent.php is not sanitised before being used. The announce variable goes through various stages throughout the script, then it is passed as a into an exec function. This occurs in the middle of the string which is passed to the exe...

Debian DSA-1206-1 : php4 - several vulnerabilities

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-3353 Tim Starling discovered that missing...

Important: Red Hat Security Advisory: php security update

Updated PHP packages that fix a security issue are now available for the Red Hat Application Stack. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. The...

PHP buffer overflow

Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the 1 htmlentities or 2 htmlspecialchars functions...

php security update

CentOS Errata and Security Advisory CESA-2006:0730-01 Updated PHP packages that fix a security issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HT...

PHP buffer overflow

Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the 1 htmlentities or 2 htmlspecialchars functions...

CVE-2006-5465: Undefined Security Weakness

Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the 1 htmlentities or 2 htmlspecialchars functions...

PHP HTMLEntities和HTMLSpecialChars函数缓冲区溢出漏洞

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP在处理HTML实体时存在漏洞，远程攻击者可能利用此漏洞在PHP服务器上执行任意指令。 PHP的HTML实体编码器在每次到达当前缓冲区末尾的时候都会增加其输出缓冲区的大小，但这种检查假设HTML实体的最大长度为8个字符。尽管这种假设在大多数情况下都是正确的，但希腊字符集就可能包含有大于8个字符的实体，因此攻击者就可以通过在输入字符串中包含希腊theta UTF-8字符来触发缓冲区溢出。...

PHP functions buffer overflow

Buffer overflow in htmlentities and htmlspecialchars on UTF-8 encoding...

punBB1211.txt

PunBB 1.2.11 Cross-Site Scripting File name :- misc.php Action :- Send Email Line :- 123 php redirect$POST'redirecturl', $langmisc'E-mail sent redirect'; /php The $POST'redirecturl' = Unfilter Input Exploit :- Send POST Request code GET :- /PunBB/misc.php?email=2 POST :-...

PunBB 1.2.11 Cross-Site Scripting

PunBB 1.2.11 Cross-Site Scripting File name :- misc.php Action :- Send Email Line :- 123 php redirect$POST'redirecturl', $langmisc'E-mail sent redirect'; /php The $POST'redirecturl' = Unfilter Input Exploit :- Send POST Request code GET :- /PunBB/misc.php?email=2 POST :-...

MyBB 1.10 New CrossSiteScripting ' member.php '

//-- MyBB 1.10 New CrossSiteScripting ' member.php ' --// Webattack :- /mybb/member.php?action=dologin&username=usrname&password=pass&url="scriptalert1;/script //-- FixIT --// Open member.php GoTo Line :- 1030 .. if$mybb-input'url' redirect$mybb-input'url', $lang-redirectloggedin; Replace It With...

WoltLab Burning Board <= 2.3.1 PL2 - XSS Vulnerability (24.04.05)

WoltLab Burning Board = 2.3.1 PL2 - XSS Vulnerability Vendor: WoltLab URL: http://www.woltlab.de/ Version: = 2.3.1 PL 2 Type: XSS Discovered by R and deluxe89 Description: -------------------------------- The WoltLab Burning Board is a high customisable forum software for every kind of use. See 1...