Habari Blog Multiple Vulnerabilities

No description provided by source. Vulnerability ID: HTB22732 Reference: http://www.htbridge.ch/advisory/pathdisclosureinhabari.html Product: Habari Vendor: Habari http://habariproject.org/en/ Vulnerable Version: 0.6.5 Vendor Notification: 02 December 2010 Vulnerability Type: Path disclosure...

PHP MicroCMS 1.0.1 CSRF and XSS Vulnerabilities

No description provided by source. Vulnerability ID: HTB22765 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpmicrocms.html Product: PHP MicroCMS Vendor: ApPHP http://www.apphp.com/ Vulnerable Version: 1.0.1 and probably prior versions Vendor Notification: 21 December 2010 Vulnerability...

Wolf CMS 0.6.0b Multiple Vulnerabilities

No description provided by source. Vulnerability ID: HTB22681 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinwolfcms.html Product: Wolf CMS Vendor: Wolf CMS team http://www.wolfcms.org/ Vulnerable Version: 0.6.0b and probably prior versions Vendor Notification: 09 November 2010 Vulnerabilit...

html-edit CMS Multiple Vulnerabilities

No description provided by source. Vulnerability ID: HTB22734 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhtmleditcms.html Product: HTML-EDIT CMS Vendor: html-edit web services http://www.html-edit.org/ Vulnerable Version: 3.1.8 Vendor Notification: 02 December 2010 Vulnerability Typ...

Juniper Junos 8.5/9.0 J-Web Interface /diagnose Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/36537/info Juniper Networks JUNOS is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data to J-Web Juniper Web Management. Attacker-supplie...

Netscape Navigator 4.0.8 'about:' Domain Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2637/info Due to a flaw in Navigator's security code, all URLs in the about: protocol are considered to be part of the same domain. If arbitrary Javascript code is placed in a GIF's comment field, it is treated like a...

diafan.cms 4.3 - Multiple Vulnerabilities

No description provided by source. Vulnerability ID: HTB22777 Reference: http://www.htbridge.ch/advisory/xsrfcsrfindiafancms.html Product: diafan.CMS Vendor: Diafan http://www.diafan.ru/ Vulnerable Version: 4.3 and probably prior versions Vendor Notification: 28 December 2010 Vulnerability Type:...

Microsoft Internet Explorer 6.0/7.0 RemoveChild Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20812/info Microsoft Internet Explorer is prone to a denial-of-service vulnerability. This issue occurs when Internet Explorer attempts to execute certain JavaScript code. Successfully exploiting this issue will cause the...

Microsoft Excel 2007 - JavaScript Code Remote Denial Of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28946/info Microsoft Excel is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to deny access to legitimate users. Given the nature of this vulnerability, attackers may also be able to...

php-decoda - Cross-Site Scripting In Video Tag

No description provided by source. Advisory: php-decoda: Cross-Site Scripting in Video Tags RedTeam Pentesting discovered a cross-site scripting XSS vulnerability in the PHP markup parser Decoda. This allows attackers that should be restricted to the markup supported by Decoda to specify a...

support.software.dell.com Cross Site Scripting

Advisory: support.software.dell.com – Cross-Site Script Vulnerability XSS Advisory ID: 14062014 Author: Roberto Garcia @1gbDeInfo Affected Software: Successfully tested on support.software.dell.com Vendor URL: https://support.software.dell.com Vendor Status: informed and solved, but nobody told m...

Updated iceape packages fix multiple vulnerabilities

Updated iceape packages fix security issues: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service memory corruption and...

CVE-2014-1539

Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it easier for remote attackers to conduct clickjacking attacks via JavaScript code that produces a fake cursor image...

Mandriva Linux Security Advisory : otrs (MDVSA-2014:111)

Updated otrs package fixes security vulnerabilities : A logged in attacker could insert special content in dynamic fields, leading to JavaScript code being executed in OTRS CVE-2014-2553. An attacker could embed OTRS in a hidden iframe tag of another page, tricking the user into clicking links in...

PHPYUN cloud talent system background CSRF Getshell-a vulnerability warning-the black bar safety net

phpyun background no authentication token, by the CSRF directly getshell First, from the background getshell start. The web site's configuration file,/plus/config.php using double quotes to do the key value, which leads to security issues. We can put php code to write into the double quotes insid...

Coremail邮件系统存储型XSS之二

简要描述： 设计错误导致可执行恶意JavaScript代码并窃取用户cookies 详细说明： 将特制的swf文件作为附件发送给受害者（这里可以选择在过节的时候下手，比如将文件名改称新年贺卡.swf）： swf文件的AS代码如下（将就着看吧，东拼西凑整出来的）： package import flash.external.ExternalInterface; import flash.display.Sprite; import flash.display.Sprite; import flash.events.Event; import flash.net.URLLoader;...

CVE-2014-1770

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript code that interacts improperly with a CollectGarbage function call on a CMarkup object allocated by the CMarkup::CreateInitialMarkup function...

CVE-2014-1743

Use-after-free vulnerability in the StyleElement::removedFromDocument function in core/dom/StyleElement.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via crafted...

CVE-2014-1743

Removed by vendor...

Cross site scripting

LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which allows remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an...