SpeedTouchXSS.txt

TITLE: Thomson SpeedTouch 500 series vulnerable to XSS CRITICAL: Less critical IMPACT: Cross Site Scripting SOFTWARE: SpeedTouch 5.3.2.6.0 DESCRIPTION: There consists a vulnerability in the SpeedTouch modems, which can be exploited by malicious people to conduct cross-site scripting attacks, and...

Thomson SpeedTouch 500 modems vulnerable to XSS

TITLE: Thomson SpeedTouch 500 series vulnerable to XSS CRITICAL: Less critical IMPACT: Cross Site Scripting SOFTWARE: SpeedTouch 5.3.2.6.0 DESCRIPTION: There consists a vulnerability in the SpeedTouch modems, which can be exploited by malicious people to conduct cross-site scripting attacks, and...

[SA18685] Daffodil CRM Login SQL Injection Vulnerability

TITLE: Daffodil CRM Login SQL Injection Vulnerability SECUNIA ADVISORY ID: SA18685 VERIFY ADVISORY: http://secunia.com/advisories/18685/ CRITICAL: Moderately critical IMPACT: Security Bypass, Manipulation of data WHERE: From remote SOFTWARE: Daffodil CRM 1.x http://secunia.com/product/7293/...

DaffodilCRM.txt

Daffodil CRM does not properly sanities it's input’s on the login page; http://www.SITE.com:8080/daffodilcrm/userlogin.jsp Therefore SQL-injection attacks are possible. PoC could be: 1'or'1'='1 Vendor’s homepage is: http://www.daffodildb.com/crm/ Please credit to: Preben Nyløkken...

[SA18683] SoftMaker Shop resultat.asp Cross-Site Scripting

TITLE: SoftMaker Shop resultat.asp Cross-Site Scripting SECUNIA ADVISORY ID: SA18683 VERIFY ADVISORY: http://secunia.com/advisories/18683/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: SoftMaker Shop http://secunia.com/product/7406/ DESCRIPTION: Preben Nylkken...

BrowserCRM vulnerable for XSS

Inputs in the BrowserCRM is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. Some fields have been filtered in a basic form, so that simple scripting like "scriptalert'XSS'/script" is not possible. Howevere, since the filtering is not based on...

XSS flaw in MG2 Image Gallery (v.0.5.1)

Users can inject XSS into the form field "Name", when adding a comment on a picture. This will lead to the execution of XSS code. Simple scripting like scriptalert'hello'/script , and more advanced document.location, and document.cookie works. This has been tested on version 0.5.1. Other versions...

EasyCMS vulnerable to XSS injection.

The Norwegian web-publishing system EasyCMS www.easycms.no contains multiple input flaws letting users conduct successful XSS attacks. Both in the admin section, and the webpage that uses the system is vulnerable to XSS. It does not filter script tags and simple scripting like...