XSS vulnerabilities in WP-ContactForm

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в WP-ContactForm. Это плагин для WordPress. Данные уязвимости - это persistent XSS. Уязвима версия плагина WP-ContactForm 1.5 alpha и предыдущие. Ранее я уже писал про уязвимости в WP-ContactForm...

bitweaver-sqlxss.txt

HSC Bitweaver XSS & SQL Injection Vulnerability Bitweaver is an open source content management system. Its speed and power are ideal for large-scale community websites and corporate applications, but it is simple enough for non-technical small site users to set up and administrate. It comes fully...

isaa-2007-004.txt

============================================= INTERNET SECURITY AUDITORS ALERT 2007-004 - Original release date: November 7th, 2007 - Last revised: December 7th, 2007 - Discovered by: Jesus Olmos Gonzalez - Severity: 4/5 ============================================= I. VULNERABILITY...

[ISecAuditors Security Advisories] wwwstats is vulnerable to Persistent XSS

============================================= INTERNET SECURITY AUDITORS ALERT 2007-004 - Original release date: November 7th, 2007 - Last revised: December 7th, 2007 - Discovered by: Jesus Olmos Gonzalez - Severity: 4/5 ============================================= I. VULNERABILITY...

MoBiC-23 Bonus: XSS in Math Comment Spam Protection

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в капче Math Comment Spam Protection. Это капча плагин для WordPress. Для атаки необходимо произвести CSRF + XSS атаку для обеих уязвимостей. Причём это persistent XSS уязвимости. XSS: Эксплоит 1:...

PR07-26: Persistent XSS on Aruba 800 Mobility Controller's login page

Date Found: 17th July 2007 Vendor informed: 23rd July 2007 Confirmed by vendor: 13th September 2007 Description: Aruba 800 is vulnerable to a persistent XSS on the administrator login screen. An unauthenticated user can re-write the hidden parameter 'url' by requesting a link under the /screens/...

ProCheckUp Security Advisory 2007.26

Date Found: 17th July 2007 Vendor informed: 23rd July 2007 Confirmed by vendor: 13th September 2007 Description: Aruba 800 is vulnerable to a persistent XSS on the administrator login screen. An unauthenticated user can re-write the hidden parameter 'url' by requesting a link under the /screens/...

phpmyadmin -- cross-site scripting vulnerability

The DigiTrust Group reports: When creating a new database, a malicious user can use a client-side Web proxy to place malicious code in the db parameter of the POST request. Since dbcreate.php does not properly sanitize user-supplied input, an administrator could face a persistent XSS attack when...

GLSA-200709-18 : Bugzilla: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200709-18 Bugzilla: Multiple vulnerabilities Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not properly sanitize the content of the 'buildid' parameter when filing bugs CVE-2007-4543. The next two vulnerabiliti...

Bugzilla: Multiple vulnerabilities

Background Bugzilla is a web application designed to help with managing software development. Description Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not properly sanitize the content of the "buildid" parameter when filing bugs CVE-2007-4543. The next two vulnerabilities onl...

eqdkp-xss.txt

In listmembers.php, $show fails to properly sanitize user-supplied input. It's non persistent XSS :-/ Example: $path-to-eqdkp/listmembers.php?show=%22%3E%3Cplaintext%3E kefka kefka at kevinbeardsucks.com...

sinecms-xss.txt

. . . . | . .| . .;/ || Infos --------- Date : 2007-04-26 ISO 8601 Product : SineCms Version : 2.3.4 last, prior versions may also be affected Vendor : http://sourceforge.net/projects/sine - http://www.sinecms.net Vendor Status : 2007-04-26 - Informed! Description : SineCms is a management...

YA Book Persistent XSS Bug

. . . . | . .| . .;/ || .| .net | .| "YA Book 0.98-alpha - Persistent XSS Vulnerability" by Omni 1 Infos --------- Date : 2007-04-23 Product : YA Book Version : 0.98-alpha - Prior version maybe also be affected Vendor : http://sourceforge.net/projects/yabook - http://www.phpee.com/ Vendor Status ...

DirectAdmin persistant XSS [takeover an Administrator`s account]

Subject: DirectAdmin persistant XSS takeover an Administrators account + Version: DirectAdmin 1.29.3 + Discovered by: Kanedaaa: http://kaneda.bohater.net + DirectAdmin Description: DirectAdmin is a popular, advanced Web Control Panel with many features for webhosting. www.directadmin.com +...

directadmin1293-xss.txt

Subject: DirectAdmin persistant XSS takeover an Administrators account + Version: alert'0wned:'+escapedocument.cookie; Lines in log files: mainlog: 2007-03-23 19:...

[Full-disclosure] WordPress Persistent XSS

Vulnerability Title: WordPress Persistent XSS Author: David Kierznowski Homepage: http://michaeldaw.org Software Vendor: WordPress Persistent XSS Versions affected: Confirmed in v2.0.5 latest See homepage for more details. WordPress was contacted: 26/12/06 22:04 BST Reply received: 27/12/06 06:11...

wp205-xss.txt

Vulnerability Title: WordPress Persistent XSS Author: David Kierznowski Homepage: http://michaeldaw.org Software Vendor: WordPress Persistent XSS Versions affected: Confirmed in v2.0.5 latest WordPress is a popular open source blogging software. A persistent XSS vulnerability has been found in...

aklink-sa-2006-001-jsboard-xss.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================ ||| Security Advisory AKLINK-SA-2006-001 ||| ||| CAN-2006-2109 CVE candidate ||| ============================================ JSBoard - Cross Site Scripting Attack ===================================== Date...

Pubcookie application server modules contain cross-site scripting vulnerabilities

Overview Cross-site scripting vulnerabilities in the Pubcookie application server modules could allow a remote attacker to gain access to sensitive information. Description Pubcookie is a software package that provides intra-institutional single-sign-on authentication for end-users over the web...

[Full-disclosure] SiteStudio

------------------------------------------------------------ - EXPL-A-2005-008 exploitlabs.com Advisory 037 - ------------------------------------------------------------ - Site Studio - AFFECTED PRODUCTS ================= Site Studio Positive Software Corporation https://www.psoft.net OVERVIEW...