webring Cross Site Scripting Vulnerability

Exploit for unknown platform in category web applications ========================================== webring Cross Site Scripting Vulnerability ========================================== ======================================================================================== | Title : webring Cro...

PRTG Traffic Grapher Monitor_Bandwidth函数跨站脚本漏洞

BUGTRAQ ID: 35128 CVECAN ID: CVE-2009-1849 PRTG Traffic Grapher是一个使用方便的Windows软件，能够对网络带宽的使用进行监控和分类。 PRTG Traffic Grapher没有正确地验证对MonitorBandwidth函数所提交的输入参数，如果用户受骗跟随了包含有恶意脚本的链接的话，就会导致在用户浏览器会话中执行跨站脚本。 Paessler PRTG Traffic Grapher 6.2.2.977 厂商补丁： Paessler -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

80sec members kevin found the IIS 6.0 0day vulnerabilities-vulnerability warning-the black bar safety net

This two-day blended really not easy Ah, a wave of linux udev just finished processing, here comes a wave of IIS 6 vulnerabilities. 8 5 After engage the safety to engage the relatively good also so a few, 80sec kevin was one, young promising Ah. This vulnerability, scratch no Ding, reproduced in...

Oracle Secure Enterprise Search 10.1.8 Linked XSS Vulnerability

Application: Oracle Secure Enterprise Search SES Versions Affected: Oracle Secure Enterprise Search SES version 10.1.8.2.0 Vendor URL: Bugs: XSS Exploits: YES Reported: 21.01.2009 Vendor response: 23.01.2009 Date of Public Advisory: 16.07.2009 CVE: CVE-2009-1968 Description: XSS IN search query...

SAP SAPDB (WEB DBM) XSS Vulnerability

Application: SAPDB Versions Affected: Last Vendor URL: Bugs: XSS Exploits: YES Reported: 20.11.2008 Vendor response: 20.11.2008 Date of Public Advisory: 31.03.2009 Description SAP MaxDB Web Database engine which listens port 9999 has a Linked XSS security vulnerability. Business Risk An attacker...

-moz-binding property bypasses security checks on codebase principals — Mozilla

Security researcher Collin Jackson reported that the -moz-binding CSS property can be used to bypass security checks which validate codebase principals. Similar to the issue reported in MFSA 2008-23, Jackson demonstrated that an attacker can replace a stylesheet in a signed JAR which uses relativ...

Unfixed XSS vulnerability at www.dockgames.com

Security researcher Mystick, has submitted on 11/10/2008 a cross-site-scripting XSS vulnerability affecting www.dockgames.com, which at the time of submission ranked 837993 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/11/2008. It is...

Google Chrome OnbeforeUload and OnUnload Null Check Vulnerability.

Advisory: Google Chrome OnbeforeUload and OnUnload Null Check Vulnerability. Version Affected: Chrome/0.2.149.30 Chrome/0.2.149.29 Chrome/0.2.149.27 Description: Google chrome is susceptible to stringent behavior while handling "onbeforeunload" and "onunload" event in body tags. The malicious...

Oracle BEA Weblogic 10 — Multiple Linked ХSS vulnerabilities

Application: Oracle BEA Weblogic 10 Versions Affected: Oracle BEA Weblogic 10 Vendor URL: Bugs: Multiple XSS Vulnerabilities in samples Exploits: YES Reported: 16.07.2008 Vendor response: 18.07.2008 Last response: 30.10.2008 Description: Review Service sample of WebLogic Server. Date of Public...

ImperialBB <= 2.3.5 Remote File Upload Exploit

No description provided by source. Title : ImperialBB = 2.3.5 Remote File Upload Vulnerability Date : 5th July 2008 Found by : PHPLizardo - http://phplizardo.2gb.fr Greetz : Gu1ll4um3r0m41n Howto : 1. Go to your User Control Panel 2. Upload any file you want 3. Tamper the request and change the...

ImperialBB 2.3.5 - Arbitrary File Upload

ImperialBB 2.3.5 - Arbitrary File Upload Title : ImperialBB :\r\n\n"; $code = trimfgetsSTDIN; $socket = @fsockopen$argv1, 80, $eno, $estr, 30...

ImperialBB 2.3.5 - Arbitrary File Upload

Title : ImperialBB :\r\n\n"; $code = trimfgetsSTDIN; $socket = @fsockopen$argv1, 80, $eno, $estr, 30; if!$socket die"Could not connect to ".$argv1."...

Unfixed XSS vulnerability at www.vertice-rock.tk

Security researcher xylitol, has submitted on 21/06/2008 a cross-site-scripting XSS vulnerability affecting www.vertice-rock.tk, which at the time of submission ranked 26502647 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/07/2008. It is...

Cross-site scripting vulnerability in the Unicode version of msearch

Overview The Unicode version of msearch, a full text search engine for websites, contains a cross-site scripting vulnerability. This problem is caused by a function added to the Unicode version of msearch. Impact A malicious script may be executed on the user's web browser. Solution None...

appservopen-xss.txt

========================================================== AppServ Open Project XSS =Example= Alert: - http://target/index.php?appservlang=" - http://target/index.php?appservlang=" Open Window - http://target/index.php?appservlang="window.open/phpinfo.php/ - http://target/index.php?appservlang="...

CVE-2003-1551

Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."...

Symantec Backup Exec Calendar ActiveX Control Multiple Vulnerabilities (SYM08-007)

The remote host contains the PVATLCalendar.PVCalendar.1 ActiveX control distributed with Symantec Backup Exec for Windows Servers. The installed version of that control reportedly contains two stack-based buffer overflows and allows for corrupting or saving malicious script code, and overwriting...

InfoSoft FusionCharts 3 - .swf Flash File Remote Code Execution

InfoSoft FusionCharts 3 - .swf Flash File Remote Code Execution source: https://www.securityfocus.com/bid/27109/info InfoSoft FusionCharts is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue t...

[Full-disclosure] 0day0day0day0day AURACMS XSS!! LATEST VERSION!!! 0day0day0day0day

0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day0day 0day0day0day0day 0day0day0day0day!!!!!!!!!!!!!!!!!!!!! BROUGHT 2 U BY UlTRa HAQRS 4 AL7 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 0day0day0day0dayTITle!!:::::::::::::AURA CMS 2.1...

Flatnuke 3 Remote Command Execution / Privilege Escalation

Exploit for unknown platform in category web applications ========================================================== Flatnuke 3 Remote Command Execution / Privilege Escalation ========================================================== --------------------------------------------------------------...