ProCheckUp Security Advisory 2007.26

Date Found: 17th July 2007 Vendor informed: 23rd July 2007 Confirmed by vendor: 13th September 2007 Description: Aruba 800 is vulnerable to a persistent XSS on the administrator login screen. An unauthenticated user can re-write the hidden parameter 'url' by requesting a link under the /screens/...

phpmyadmin -- cross-site scripting vulnerability

The DigiTrust Group reports: When creating a new database, a malicious user can use a client-side Web proxy to place malicious code in the db parameter of the POST request. Since dbcreate.php does not properly sanitize user-supplied input, an administrator could face a persistent XSS attack when...

GLSA-200709-18 : Bugzilla: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200709-18 Bugzilla: Multiple vulnerabilities Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not properly sanitize the content of the 'buildid' parameter when filing bugs CVE-2007-4543. The next two vulnerabiliti...

Bugzilla: Multiple vulnerabilities

Background Bugzilla is a web application designed to help with managing software development. Description Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not properly sanitize the content of the "buildid" parameter when filing bugs CVE-2007-4543. The next two vulnerabilities onl...

eqdkp-xss.txt

In listmembers.php, $show fails to properly sanitize user-supplied input. It's non persistent XSS :-/ Example: $path-to-eqdkp/listmembers.php?show=%22%3E%3Cplaintext%3E kefka kefka at kevinbeardsucks.com...

sinecms-xss.txt

. . . . | . .| . .;/ || Infos --------- Date : 2007-04-26 ISO 8601 Product : SineCms Version : 2.3.4 last, prior versions may also be affected Vendor : http://sourceforge.net/projects/sine - http://www.sinecms.net Vendor Status : 2007-04-26 - Informed! Description : SineCms is a management...

YA Book Persistent XSS Bug

. . . . | . .| . .;/ || .| .net | .| "YA Book 0.98-alpha - Persistent XSS Vulnerability" by Omni 1 Infos --------- Date : 2007-04-23 Product : YA Book Version : 0.98-alpha - Prior version maybe also be affected Vendor : http://sourceforge.net/projects/yabook - http://www.phpee.com/ Vendor Status ...

directadmin1293-xss.txt

Subject: DirectAdmin persistant XSS takeover an Administrators account + Version: alert'0wned:'+escapedocument.cookie; Lines in log files: mainlog: 2007-03-23 19:...

DirectAdmin persistant XSS [takeover an Administrator`s account]

Subject: DirectAdmin persistant XSS takeover an Administrators account + Version: DirectAdmin 1.29.3 + Discovered by: Kanedaaa: http://kaneda.bohater.net + DirectAdmin Description: DirectAdmin is a popular, advanced Web Control Panel with many features for webhosting. www.directadmin.com +...

wp205-xss.txt

Vulnerability Title: WordPress Persistent XSS Author: David Kierznowski Homepage: http://michaeldaw.org Software Vendor: WordPress Persistent XSS Versions affected: Confirmed in v2.0.5 latest WordPress is a popular open source blogging software. A persistent XSS vulnerability has been found in...

[Full-disclosure] WordPress Persistent XSS

Vulnerability Title: WordPress Persistent XSS Author: David Kierznowski Homepage: http://michaeldaw.org Software Vendor: WordPress Persistent XSS Versions affected: Confirmed in v2.0.5 latest See homepage for more details. WordPress was contacted: 26/12/06 22:04 BST Reply received: 27/12/06 06:11...

aklink-sa-2006-001-jsboard-xss.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================ ||| Security Advisory AKLINK-SA-2006-001 ||| ||| CAN-2006-2109 CVE candidate ||| ============================================ JSBoard - Cross Site Scripting Attack ===================================== Date...

Pubcookie application server modules contain cross-site scripting vulnerabilities

Overview Cross-site scripting vulnerabilities in the Pubcookie application server modules could allow a remote attacker to gain access to sensitive information. Description Pubcookie is a software package that provides intra-institutional single-sign-on authentication for end-users over the web...

[Full-disclosure] SiteStudio

------------------------------------------------------------ - EXPL-A-2005-008 exploitlabs.com Advisory 037 - ------------------------------------------------------------ - Site Studio - AFFECTED PRODUCTS ================= Site Studio Positive Software Corporation https://www.psoft.net OVERVIEW...

Exploit Labs Security Advisory 2005.6

------------------------------------------------------------ - EXPL-A-2005-006 exploitlabs.com Advisory 034 - ------------------------------------------------------------ - XAMPP - OVERVIEW ======== XAMPP is an easy to install Apache distribution containing MySQL, PHP and Perl. XAMPP is really ve...

ICQ Webfront - Persistant XSS

------------------------------------------------------------------ - EXPL-A-2003-024 exploitlabs.com Advisory 024 ------------------------------------------------------------------ -= ICQ Webfront =- Donnie Werner Sept 09 2003 exploitlabs.com Vunerabilitys: ---------------- 1. Persistant Remote X...

PtHProductions Gastenboek - XSS

------------------------------------------------------------------ - EXPL-A-2003-022 exploitlabs.com Advisory 022 ------------------------------------------------------------------ -= PtHProductions Gastenboek =- Donnie Werner Aug, 29 2003 Vunerabilitys: ---------------- 1. Persistant XSS injecti...