CVE-2005-4455

CVE-2005-4455 affects cleanhtml.pl 1.129 in LiveJournal CVS prior to 13 Dec 2005. The issue arises from injecting scripting languages via the XSL namespace in XML, exploitable through vectors such as customview.cgi. Impact is remote code execution-like scripting injection, as described by the vul...

CVE-2005-4454

Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows remote attackers to conduct cross-site scripting XSS attacks via a "" backslash within a "javascript" scheme in a style property such as "javas\cript", whic...

CVE-2005-4455

cleanhtml.pl 1.129 in LiveJournal CVS before Dec 13 2005 allows remote attackers to inject scripting languages via the XSL namespace in XML, via vectors such as customview.cgi...

CVE-2005-4454

CVE-2005-4454 affects LiveJournal’s cleanhtml.pl 1.129 prior to Dec 7, 2005. The issue arises when the cleancss option is enabled: a backslash in a javascript: URL within a style property can bypass the javascript check and be rendered as script in browsers that permit scripting in styles, enabli...

[Full-disclosure] LiveJournal CSS/JS injection vulnerability

SUMMARY ---------------------------------------------------------------------- The popular Livejournal1 social networking software contained an error which allowed for the inclusion of Javascript in user-supplied content. 1 http://www.livejournal.org/, http://www.livejournal.com/ BACKGROUND...

LiveJournal - Cleanhtml.pl HTML Injection

LiveJournal - Cleanhtml.pl HTML Injection source: https://www.securityfocus.com/bid/15990/info LiveJournal is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content...

LiveJournal - Cleanhtml.pl HTML Injection

source: https://www.securityfocus.com/bid/15990/info LiveJournal is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would b...

CVE-2004-0310

Cross-site scripting XSS vulnerability in LiveJournal 1.0 and 1.1 allows remote attackers to execute Javascript as other users via the stylesheet, which does not strip the semicolon or parentheses, as demonstrated using a background:url...

CVE-2004-0310

CVE-2004-0310 describes a cross-site scripting (XSS) vulnerability in LiveJournal 1.0 and 1.1. The issue arises in the site’s stylesheet handling, where semicolon/parentheses are not stripped, enabling a remote attacker to execute JavaScript as another user via a crafted stylesheet (demonstrated ...

CVE-2004-0310

Cross-site scripting XSS vulnerability in LiveJournal 1.0 and 1.1 allows remote attackers to execute Javascript as other users via the stylesheet, which does not strip the semicolon or parentheses, as demonstrated using a background:url...

LiveJournal 1.1 - CSS HTML Injection

LiveJournal 1.1 - CSS HTML Injection source: https://www.securityfocus.com/bid/9727/info LiveJournal is reportedly prone to HTML injection via Cascading Style Sheet CSS tags. It is possible to inject hostile HTML and script code into journal entries through this vulnerability. This could...

LiveJournal 1.1 - CSS HTML Injection

source: https://www.securityfocus.com/bid/9727/info LiveJournal is reportedly prone to HTML injection via Cascading Style Sheet CSS tags. It is possible to inject hostile HTML and script code into journal entries through this vulnerability. This could potentially be exploited to steal cookies fro...