6233 matches found
Core Security Technologies Advisory 2007.0817
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies – CoreLabs Advisory http://www.coresecurity.com/corelabs Remote command execution, HTML and JavaScript injection vulnerabilities in AOL’s Instant Messaging software Advisory Information Title: Remote Command execution, HTML...
CVE-2007-5046
Cross-site scripting XSS vulnerability in the Webmail interface for IceWarp Merak Mail Server before 9.0.0 allows remote attackers to inject arbitrary JavaScript via a javascript: URI in an attribute of an element in an email message body, as demonstrated by the onload attribute in a BODY element...
CVE-2007-3017: Undefined Security Weakness
The WYSIWYG editor applet in activeWeb contentserver CMS before 5.6.2964 only filters malicious tags from articles sent to admin/applets/wysiwyg/rendereditor.asp, which allows remote authenticated users to inject arbitrary JavaScript via a request to admin/worklist/worklistedit.asp...
Unfixed XSS vulnerability at www.wardom.org
Security researcher Babaconda, has submitted on 07/09/2007 a cross-site-scripting XSS vulnerability affecting www.wardom.org, which at the time of submission ranked 37698 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/09/2007. It is current...
CVE-2007-3150
Google Desktop allows user-assisted remote attackers to execute arbitrary programs via a man-in-the-middle attack that injects JavaScript, a www.google.com search IFRAME, and a META HTTP-EQUIV="refresh" that targets a www.google.com search for a local .exe file, which is displayed in the "results...
CVE-2007-3150: Undefined Security Weakness
Google Desktop allows user-assisted remote attackers to execute arbitrary programs via a man-in-the-middle attack that injects JavaScript, a www.google.com search IFRAME, and a META HTTP-EQUIV="refresh" that targets a www.google.com search for a local .exe file, which is displayed in the "results...
Portcullis Security Advisory 06-035
Portcullis Security Advisory 06-035 Vulnerable System: Movable Type. Vulnerability Title: The create entry mechanism is vulnerable to JavaScript injection. Vulnerability Discovery And Development: Portcullis Security Testing Services Credit for Discovery: Tim Brown - Portcullis Computer Security...
NDSA20070412.txt
Nth Dimension Security Advisory NDSA20070412 Date: 12th April 2007 Author: Tim Brown URL: / Product: DSL-G624T router V3.00B01T02.UK-A.20060208 Vendor: D-Link Risk: Medium Summary Following the Securiteam posting "D-Link DSL-G604T Wireless Router Directory Traversal" which described a directory...
DSA-1275-1 zope2.7 - cross-site scripting
Bulletin has no description...
CVE-2007-1395
Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting XSS attacks by injecting arbitrary JavaScript or HTML in a 1 db or 2 table parameter value followed by an uppercase end tag, which bypasses the protection...
CVE-2006-7050: Undefined Security Weakness
Cross-site scripting XSS vulnerability in WikkaWiki Wikka Wiki before 1.1.6.2 allows remote attackers to inject arbitrary javascript via 1 events in forced links url parameter that are not properly handled in formatters/wakka.php, and possibly 2 other vectors in wikka.php...
Portcullis Security Advisory - Movable Type
Portcullis Security Advisory Tim Brown [email protected] - www.portcullis-security.com [email protected] - www.nth-dimension.org.uk Vulnerable System: Movable Type Vulnerability Title: Username and password hash for administration interface stored in cookie. Vulnerability...
CVE-2006-4975
Yahoo! Messenger for WAP permits saving messages that contain JavaScript, which allows user-assisted remote attackers to inject arbitrary web script or HTML via a URL at the online service...
CVE-2006-4975: Undefined Security Weakness
Yahoo! Messenger for WAP permits saving messages that contain JavaScript, which allows user-assisted remote attackers to inject arbitrary web script or HTML via a URL at the online service...
[Full-disclosure] Lyris ListManager 8.95: Add arbitrary administrator to arbitrary list
Advisory: Lyris ListManager 8.95: Add arbitrary administrator to arbitrary list Release Date: 2006-08-30 Application: Lyris ListManager 8.95 Risk: Depends upon your use and business context Vendor site: http://www.lyris.com/ Overview of Product: "Lyris ListManager is the world's most popular...
CVE-2006-3211
Cross-site scripting XSS vulnerability in sign.php in cjGuestbook 1.3 and earlier allows remote attackers to inject Javascript code via a javascript URI in an img bbcode tag in the comments parameter...
CVE-2006-2611
MediaWiki 1.6.x is affected in includes/Sanitizer.php (variable handler) by CVE-2006-2611. The vulnerability allows remote attackers to inject arbitrary Javascript via unspecified vectors, possibly involving the | character, and is exploitable before revision r14349. The NVD notes a Medium risk w...
FreeBSD : mozilla -- multiple vulnerabilities (84630f4a-cd8c-11da-b7b9-000c6ec775d9)
A Mozilla Foundation Security Advisory reports of multiple issues. Several of which can be used to run arbitrary code with the privilege of the user running the program. - MFSA 2006-29 Spoofing with translucent windows - MFSA 2006-28 Security check of jsValueToFunctionObject can be circumvented -...
ChipmunkBoard Multiple Attack vectors
ChipmunkBoard Multiple Attack vectors Discovered by: Nomenumbra Date: 6/4/2006 impact:high privilege escalation,possible defacement It is possible to insert the following javascript in the BBcode or supply it as your avatar url: javascript:alert27xss27; Also ChipmunkBoard is prone to SQL-injectio...