Flash Tag Cloud And MT-Cumulus Plugin - 'tagcloud' Cross-Site Scripting

source: https://www.securityfocus.com/bid/47845/info The Flash Tag Cloud widget and the MT-Cumulus Plugin are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the brows...

Уязвимость в MT-Cumulus для Movable Type

Здравствуйте 3APA3A! Сообщаю вам о Cross-Site Scripting уязвимости в плагине MT-Cumulus для Movable Type. Данная XSS уязвимость идентична XSS уязвимости в WP-Cumulus, т.к. приложение использует tagcloud.swf разработанный автором WP-Cumulus. Про миллионы флешек tagcloud.swf уязвимых к XSS атакам я...

MT-Cumulus / MT 4 Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting vulnerability in plugin MT-Cumulus for Movable Type. ------------------------- Affected products: ------------------------- At first the developer made widget Flash Tag Cloud For MT 4, and later made full-fledged plugin MT-Cumulus for...

Directory traversal

Directory traversal vulnerability in the MT Fire Eagle commtfireeagle component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php...

CVE-2010-1719

Directory traversal vulnerability in the MT Fire Eagle commtfireeagle component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php...

CVE-2010-1719

CVE-2010-1719 describes a directory traversal (local file inclusion) vulnerability in the Joomla! component MT Fire Eagle 1.2 (com_mtfireeagle). The issue allows remote attackers to read arbitrary files via a ".." in the controller parameter to index.php, potentially impacting confidentiality, in...

CVE-2010-1719: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the MT Fire Eagle commtfireeagle component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php...

Joomla MT Fire Eagle 1.2 Local File Inclusion

================================================================================================================= o Joomla Component MT Fire Eagle Local File Inclusion Vulnerability Software : commtfireeagle version 1.2 Vendor : http://www.moto-treks.com/ Download :...

Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion

Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion ================================================================================================================= o Joomla Component MT Fire Eagle Local File Inclusion Vulnerability Software : commtfireeagle version 1.2 Vendor :...

Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion

================================================================================================================= o Joomla Component MT Fire Eagle Local File Inclusion Vulnerability Software : commtfireeagle version 1.2 Vendor : http://www.moto-treks.com/ Download :...

SLES9: Security update for Qt3

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: qt3-devel qt3 qt3-non-mt For more information, please visit the referenced security advisories. More details may also be found by searching for keyword 50122...

CVE-2009-2492

Cross-site scripting XSS vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-2480...

CVE-2009-2492

CVE-2009-2492 describes a cross-site scripting (XSS) vulnerability in the Movable Type web application, specifically in the mt-wizard.cgi component. Affected software is Six Apart Movable Type prior to version 4.261. The vulnerability allows remote attackers to inject arbitrary web script or HTML...

CVE-2009-2492: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-2480...

CVE-2009-2481

mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and 1 send e-mail to arbitrary addresses or 2 obtain sensitive information via unspecified vectors...

CVE-2009-2480

CVE-2009-2480 is an XSS in Movable Type’s mt-wizard.cgi affecting versions 4.24 and 4.25 when global templates are not initialized. The vulnerability arises from unsanitized input in the set_static_uri_to parameter, enabling a remote attacker to inject arbitrary script or HTML. Nessus NASL notes ...

CVE-2009-2481

Summary: CVE-2009-2481 affects Movable Type prior to 4.261. When global templates are not initialized, mt-wizard.cgi allows remote bypass of access restrictions, enabling (1) sending email to arbitrary addresses and (2) obtaining sensitive information via unspecified vectors. Affected software: M...

CVE-2009-2481: Improper Authentication

mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and 1 send e-mail to arbitrary addresses or 2 obtain sensitive information via unspecified vectors...

CVE-2009-2480: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mt-wizard.cgi in Six Apart Movable Type 4.24, and 4.25 when global templates are not initialized, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Movable Type mt-wizard.cgi set_static_uri_to Parameter XSS

The version of Movable Type running on the remote host has a cross- site scripting vulnerability in 'mt-wizard.cgi'. Input to the 'setstaticurito' parameter is not sanitized. A remote attacker could exploit this by tricking a user into submitting a specially crafted POST request, which would...