JAWS HTML injection vulnerabilities

The remote version of JAWS does not perform a proper validation of user-supplied input to several variables used in the SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

File Inclusion Vulnerability in Jaws

The remote host is running JAWS, a content management system written in PHP. The remote version of Jaws allows an attacker to include URLs remotely. SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CVE-2005-3955

Multiple cross-site scripting XSS vulnerabilities in MagpieRSS 7.1, as used in a blogBuddiesv 0.3, b Jaws 0.6.2, and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the 1 url parameter to a magpiedebug.php and 2 rssurl parameter to b magpieslashbox.php a...

CVE-2004-2445

CVE-2004-2445: Directory traversal in Jaws 0.3 BETA index.php via the gadget parameter allows remote attackers to view arbitrary files using dot-dot sequences. This is documented in multiple sources (NVD/CVE records and Nessus-like disclosures) and confirms a file-read vulnerability in the early ...

CVE-2004-2443

The CVE affects Jaws 0.3. An authentication bypass is possible via an HTTP request to admin.php where the cookie is set to the MD5 hash of a null password; this is compared against the logged session variable in application.php’s logged_on function. This yields a likely auth bypass with partial c...

CVE-2004-2444

CVE-2004-2444 describes a cross-site scripting (XSS) flaw in index.php of Jaws 0.3, exploitable via the action parameter to inject arbitrary script/HTML. The provided documents do not include explicit vendor/version patches or a confirmed exploit in the wild. No additional technical details, root...

CVE-2004-2445

Directory traversal vulnerability in index.php in Jaws 0.3 BETA allows remote attackers to view arbitrary files via a .. dot dot in the gadget parameter...

CVE-2004-2443

Jaws 0.3 allows remote attackers to bypass authentication and via an HTTP request to admin.php with the logged cookie set to the MD5 hash of a null password, which is compared against the logged session variable by the loggedon function in application.php...

CVE-2004-2444

Cross-site scripting XSS vulnerability in index.php in Jaws 0.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

jawsGlossary.txt

XSS Bug in Jaws Glossary v 0.4 - 0.5.1 latest version STATUS: The vendor has been contacted, fixed in cvs. Jaws is a Framework and Content Management System for building dynamic web sites. It aims to be User Friendly giving ease of use and lots of ways to customize web sites, but at the same time...

JAWS Glossary Gadget Multiple XSS

The remote host is running JAWS, a content management system written in PHP. The remote version of this software does not perform a proper validation of user-supplied input to several variables used in the 'GlossaryModel.php' script, and is, therefore, vulnerable to cross-site scripting attacks...

Jaws BlogModel.php path Parameter Remote File Inclusion

The remote host is running JAWS, a content management system written in PHP. The remote version of Jaws allows an attacker to include URLs remotely. This may allow for the execution of arbitrary code with the privileges of the web server. %NASLMINLEVEL 70300 This script was written by Josh...

CVE-2005-2179

PHP remote file inclusion vulnerability in BlogModel.php in Jaws 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via the path parameter...

CVE-2005-2179

CVE-2005-2179 describes a PHP remote file inclusion vulnerability in Jaws (BlogModel.php) affecting version 0.5.2 and earlier. The flaw allows an attacker to include URLs via the path parameter, enabling arbitrary PHP code execution on the web server. Affected software is the Jaws CMS written in ...

[Full-disclosure] Advisory 07/2005: Jaws Multiple Remote Code Execution Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Jaws Multiple Remote Code Execution Vulnerabilities Release Date: 2005/07/06 Last Modified: 2005/07/06 Author: Stefan Esser [email protected] Application: Jaws = 0.5.2...

Jaws 0.x - Remote File Inclusion

source: https://www.securityfocus.com/bid/14158/info JAWS is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary server-side script code on an affected...

Jaws 0.x - Remote File Inclusion

Jaws 0.x - Remote File Inclusion source: https://www.securityfocus.com/bid/14158/info JAWS is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...

CVE-2005-1800

JAWS Glossary Gadget XSS (CVE-2005-1800) affects versions 0.4–0.5.1. The flaw stems from inadequate validation of user input in the GlossaryModel/view term handling for the term parameter to index.php, allowing remote script/HTML injection via XSS. Impact is web-based cross-site scripting; exploi...

CVE-2005-1800

Cross-site scripting XSS vulnerability in Jaws Glossary gadget 0.4 to 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the term parameter in a view or ViewTerm action to index.php...

jawsXSS.txt

Small XSS Bug in JAWS gadget: Glossary all versions vulnerable 0.3 - 0.5 latest beta beta2 STATUS: The vendor has been contacted and they fixed the bug but they havent released an official patch yet. You can find a provisional patch at the end of the file TECHNICAL INFO...