CVE-2008-1257

Cross-site scripting XSS vulnerability in Forms/DiagGeneral2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitrary web script or HTML via the PingIPAddr parameter...

mod_autoindex XSS

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

mod_autoindex XSS

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

mod_autoindex XSS

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

CVE-2008-0191

WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and the SQL database structure...

CVE-2007-6658

SQL injection vulnerability in admin.php/vars.php in CustomCMS CCMS 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page...

Sql injection

SQL injection vulnerability in admin.php/vars.php in CustomCMS CCMS 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page...

CVE-2007-6648

Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter...

ZyXEL P-330W跨站脚本执行及请求伪造漏洞

BUGTRAQ ID: 27024 ZyXEL P-330W是一款无线宽带路由器。 ZyXEL P-330W处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞攻击用户系统。 ZyXEL P-330W的ping.asp文件中没有正确地过滤对pingstr参数的输入便返回给了用户，这允许攻击者通过跨站脚本在用户浏览器会话中执行任意HTML和脚本代码；此外设备还允许用户通过HTTP请求执行各种操作，但没有验证请求的有效性，这可能允许攻击者通过伪造请求执行各种攻击，如更改管理员口令。 ZyXEL P-330W ZyXEL -----...

zyxel-xssxsrf.txt

ZyXEL P-330W “Secure Wireless Internet Sharing Router” is vulnerable to multiple XSS and XSRF attacks. There are a plethora of XSS vulns in the web-based management interface so I'll leave it to you to discover these gifts on your own. Here is a starting point: http://:/ping.asp?pingstr=”alert"M...

ZYXEL P-330W - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/27024/info ZyXEL P-330W 802.11g Secure Wireless Internet Sharing Router is prone to multiple cross-site scripting vulnerabilities and cross-site request-forgery vulnerabilities because it fails to properly sanitize user-supplied input. These issues affect...

Unfixed XSS vulnerability at www.uga.edu

Security researcher George P. Burdell, has submitted on 26/11/2007 a cross-site-scripting XSS vulnerability affecting www.uga.edu, which at the time of submission ranked 7854 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is...

Cross site scripting

Cross-site scripting XSS vulnerability in buscar.asp in Solidweb Novus 1.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Unfixed XSS vulnerability at www.h-o-m-e-p-a-g-e.info

Security researcher T-Ping, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.h-o-m-e-p-a-g-e.info, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/09/2007. It is...

DEBIAN-CVE-2007-4465

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

PT-2007-5645 · Apache +1 · Apache Http Server +1

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions prior to 2.2.6 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset when the charset on a server-generated page is...

CVE-2007-4805

CVE-2007-4805 affects fuzzylime (CMS) getgalldata.php in version 3.0 and earlier. A directory traversal flaw lets remote attackers include arbitrary local files by supplying .. in the p parameter. The root cause is unvalidated path input leading to local file inclusion. Public references in conne...

CVE-2007-4256

Directory traversal vulnerability in showpage.cgi in YNP Portal System 2.2.0 allows remote attackers to read arbitrary files via a .. dot dot in the p parameter...

Fedora Core 6 : postgresql-8.1.9-1.fc6 (2007-565)

Update to PostgreSQL 8.1.9 for CVE-2007-2138, data loss bugs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

CVE-2007-2738

The CVE-2007-2738 entry corresponds to a SQL injection vulnerability in the Glossaire module for XOOPS (version 1.7 and earlier). The flaw resides in glossaire-p-f.php, where the sid parameter used in an ImprDef action is not properly sanitized, allowing remote attackers to execute arbitrary SQL ...