955 matches found
CUPS < 1.4.2 kerberos Parameter XSS
According to its banner, the version of CUPS installed on the remote host is earlier than 1.4.2. The 'kerberos' parameter in such versions is not properly sanitized before being used to generate dynamic HTML content. An attacker can leverage this issue via a combination of attribute injection and...
GLSA-200909-06 : aMule: Parameter injection
The remote host is affected by the vulnerability described in GLSA-200909-06 aMule: Parameter injection Sam Hocevar discovered that the aMule preview function does not properly sanitize file names. Impact : A remote attacker could entice a user to download a file with a specially crafted file nam...
aMule: Parameter injection
Background aMule is an eMule-like client for the eD2k and Kademlia networks, supporting multiple platforms. Description Sam Hocevar discovered that the aMule preview function does not properly sanitize file names. Impact A remote attacker could entice a user to download a file with a specially...
Perl$hop e-commerce Script Trust Boundary Input Parameter Injection
Exploit for cgi platform in category web applications =================================================================== Perl$hop e-commerce Script Trust Boundary Input Parameter Injection =================================================================== A while back I was playing around with...
Perl$hop e-commerce Script Trust Boundary Input Parameter Injection
No description provided by source. A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a lot of vulnerabilities for one...
Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection
Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a l...
CVE-2009-2156
Multiple cross-site scripting XSS vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Title field to requests.php, related to viewrequests.php; and 2 the Torrent Name field to torrents-upload.php, related to the logging o...
Directory traversal
Multiple directory traversal vulnerabilities in Blogplus 1.0 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 rowmysqlblockscenterdownfile parameter to includes/blockcenterdown.php; 2 rowmysqlblockscentertopfile includes/parameter to blockcentertop.php...
[DSECRG-09-013] IBM WebSphere Application Server 7.0 Multiple XSS Vulnerabilities
Digital Security Research Group DSecRG Advisory DSECRG-09-013 !!! official advisory: !!! http://dsecrg.com/pages/vul/DSECRG-09-013.html Application: IBM WebSphere Application Server Versions Affected: 7.0 and 6.1 Vendor URL: http://www.ibm.com/websphere/ Bug: Multiple XSS Vulnerabilities Exploits...
Design/Logic Flaw
The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...
CVE-2008-6531
The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...
CVE-2008-6531
Affected software: Atlassian Jira (
Google Chrome 1.0.154.46 (ChromeHTML://) Parameter Injection PoC
No description provided by source. Try this: chromehtml:"%20--renderer-path="calc"%20--no-sandbox Disabling sandbox does matter : Tested with Google Chrome Chrome 1.0.154.46 on Win XP/Vista and IE6/IE7 and it works ... Full PoC: htmlheadtitleChrome URI Handler Remote Command Execution...
Google Chrome code execution
chromehtml: URI parameter injection...
Re: Re: Google Chrome Browser (ChromeHTML://) remote parameter injection POC
Try this: chromehtml:"20--renderer-path="calc"20--no-sandbox Disabling sandbox does matter : Tested with Google Chrome Chrome 1.0.154.46 on Win XP/Vista and IE6/IE7 and it works ... Full PoC: htmlheadtitleChrome URI Handler Remote Command Execution PoC/title/head body h3This is a test/h3 iframe...
Google Chrome 1.0.154.46 (ChromeHTML://) Parameter Injection PoC
Exploit for unknown platform in category remote exploits ================================================================ Google Chrome 1.0.154.46 ChromeHTML:// Parameter Injection PoC ================================================================ Try this:...
Google Chrome Parameter Injection
click me...
Internet Explorer 'chromeHTML://'命令行参数注入漏洞
BUGTRAQ ID: 32999 Internet Explorer是一款流行的WEB浏览器。 Internet Explorer不正确处理用户输入，远程攻击者可以利用漏洞通过协议处理器注入命令行参数，造成以登录用户上下文执行任意代码。 问题是处理'chromeHTML://'协议存在问题，构建恶意WEB页，诱使用户访问可触发此漏洞。 Microsoft Internet Explorer 8 beta 2 目前没有解决方案提供： http://www.microsoft.com/ie/ !-- Google Chrome Browser ChromeHTML:// remote...
Google Chrome Browser (ChromeHTML://) Remote Parameter Injection
No description provided by source. !-- Google Chrome Browser ChromeHTML:// remote parameter injection POC by Nine:Situations:Group::bellick&strawdog Site: http://retrogod.altervista.org/ tested against: Internet Explorer 8 beta 2, Google Chrome 1.0.154.36, Microsoft Windows XP SP3 List of command...
Google Chrome Browser (ChromeHTML://) Remote Parameter Injection
Exploit for unknown platform in category remote exploits ================================================================ Google Chrome Browser ChromeHTML:// Remote Parameter Injection ================================================================ 0day.today 2018-03-01...