1783 matches found
CVE-2008-1261
The CVE-2008-1261 entry affects the Zyxel P-2602HW-D1A router (firmware 3.40(AJZ.1)). The vulnerability arises because the device’s admin page responses differ based on whether a user is logged in, enabling remote attackers to learn the current login status by requesting an arbitrary admin URI. T...
CVE-2008-1257
Cross-site scripting XSS vulnerability in Forms/DiagGeneral2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitrary web script or HTML via the PingIPAddr parameter...
CVE-2008-1257
CVE-2008-1257 is a cross-site scripting (XSS) vulnerability affecting ZyXEL P-660HW series routers, exploitable via the PingIPAddr parameter under Forms/DiagGeneral_2. Attackers can inject arbitrary web script or HTML in the router’s web interface. According to the connected NVD entry, the affect...
mod_autoindex XSS
Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...
mod_autoindex XSS
Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...
mod_autoindex XSS
Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...
CVE-2008-0191
WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and the SQL database structure...
CVE-2007-6658
SQL injection vulnerability in admin.php/vars.php in CustomCMS CCMS 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page...
Sql injection
SQL injection vulnerability in admin.php/vars.php in CustomCMS CCMS 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page...
CVE-2007-6648
Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter...
ZyXEL P-330W跨站脚本执行及请求伪造漏洞
BUGTRAQ ID: 27024 ZyXEL P-330W是一款无线宽带路由器。 ZyXEL P-330W处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞攻击用户系统。 ZyXEL P-330W的ping.asp文件中没有正确地过滤对pingstr参数的输入便返回给了用户，这允许攻击者通过跨站脚本在用户浏览器会话中执行任意HTML和脚本代码；此外设备还允许用户通过HTTP请求执行各种操作，但没有验证请求的有效性，这可能允许攻击者通过伪造请求执行各种攻击，如更改管理员口令。 ZyXEL P-330W ZyXEL -----...
zyxel-xssxsrf.txt
ZyXEL P-330W “Secure Wireless Internet Sharing Router” is vulnerable to multiple XSS and XSRF attacks. There are a plethora of XSS vulns in the web-based management interface so I'll leave it to you to discover these gifts on your own. Here is a starting point: http://:/ping.asp?pingstr=”alert"M...
ZYXEL P-330W - Multiple Vulnerabilities
source: https://www.securityfocus.com/bid/27024/info ZyXEL P-330W 802.11g Secure Wireless Internet Sharing Router is prone to multiple cross-site scripting vulnerabilities and cross-site request-forgery vulnerabilities because it fails to properly sanitize user-supplied input. These issues affect...
Unfixed XSS vulnerability at www.uga.edu
Security researcher George P. Burdell, has submitted on 26/11/2007 a cross-site-scripting XSS vulnerability affecting www.uga.edu, which at the time of submission ranked 7854 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is...
Cross site scripting
Cross-site scripting XSS vulnerability in buscar.asp in Solidweb Novus 1.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
Unfixed XSS vulnerability at www.h-o-m-e-p-a-g-e.info
Security researcher T-Ping, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.h-o-m-e-p-a-g-e.info, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/09/2007. It is...
DEBIAN-CVE-2007-4465
Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...
PT-2007-5645 · Apache +1 · Apache Http Server +1
Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions prior to 2.2.6 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset when the charset on a server-generated page is...
CVE-2007-4805
CVE-2007-4805 affects fuzzylime (CMS) getgalldata.php in version 3.0 and earlier. A directory traversal flaw lets remote attackers include arbitrary local files by supplying .. in the p parameter. The root cause is unvalidated path input leading to local file inclusion. Public references in conne...
