CVE-2007-1141

PHP remote file inclusion vulnerability in preview.php in Magic News Plus 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the phpscriptpath parameter. NOTE: This issue may overlap CVE-2006-0723...

XMB "U2U Instant Messenger" Cross-Site Scripting

Aria-Security Team http://Aria-Security.com Contact: [email protected] Type:Remote Cross-Site Scripting Article on XSS: http://aria-security.net/xss.rar Discovered By Aria-Security Team Software: XMB U2u Instant Messenger Explanation: First of all user must be REGISTERED - Go to...

MOAB-06-01-2007: Multiple Vendor PDF Document Catalog Handling Vulnerability

Summary The Adobe Portable Document Format PDF, specification v. 1.3 defines the root of a document's object hierarchy as the "catalog dictionary". The catalog contains the necessary references to objects and data that compose the document contents and their attributes. Also, it contains directiv...

MOAB-06-01-2007: Multiple Vendor PDF Document Catalog Handling Vulnerability

Summary The Adobe Portable Document Format PDF, specification v. 1.3 defines the root of a document's object hierarchy as the "catalog dictionary". The catalog contains the necessary references to objects and data that compose the document contents and their attributes. Also, it contains directiv...

CVE-2007-0384: Undefined Security Weakness

Cross-site scripting XSS vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-0102

The Adobe PDF specification 1.3, as implemented by Apple Mac OS X Preview, allows remote attackers to have an unknown impact, possibly including denial of service infinite loop, arbitrary code execution, or memory corruption, via a PDF file with a 1 crafted catalog dictionary or 2 a crafted Pages...

Memory corruption

The Adobe PDF specification 1.3, as implemented by Apple Mac OS X Preview, allows remote attackers to have an unknown impact, possibly including denial of service infinite loop, arbitrary code execution, or memory corruption, via a PDF file with a 1 crafted catalog dictionary or 2 a crafted Pages...

CVE-2007-0102: Improper Input Validation

The Adobe PDF specification 1.3, as implemented by Apple Mac OS X Preview, allows remote attackers to have an unknown impact, possibly including denial of service infinite loop, arbitrary code execution, or memory corruption, via a PDF file with a 1 crafted catalog dictionary or 2 a crafted Pages...

CVE-2007-0102

The CVE-2007-0102 entry concerns Adobe PDF 1.3 parsing as implemented by Apple Preview. A crafted PDF catalog dictionary or Pages attribute referencing an invalid page tree node may trigger an infinite loop, memory corruption, or arbitrary code execution. Connected sources corroborate a DoS/vecto...

cmsms102-xss.txt

/|| \ | || \ / ||\ / || |\| || / || \ \ || | \ || |/| || / ||| ||| |||/ http://www.nanoy.org Hacker.: NanoyMaster CMS....: CMS Made Simple Version: 1.0.2 --------exploits---------- 1 Search XSS non-permanent 2 preview XSS non-permanent 3 Admin login XSS non-permanent 4 Outro...

CMS Made Simple non-permanent XSS

/|| | || / || / || || || / || || | || |/| || / ||| ||| |||/ http://www.nanoy.org Hacker.: NanoyMaster CMS....: CMS Made Simple Version: 1.0.2 --------exploits---------- 1 Search XSS non-permanent 2 preview XSS non-permanent 3 Admin login XSS non-permanent 4 Outro --------------------NM--...

CMS Made Simple non-permanent XSS

/|| | || / || / || || || / || || | || |/| || / ||| ||| |||/ http://www.nanoy.org Hacker.: NanoyMaster CMS....: CMS Made Simple Version: 1.0.2 --------exploits---------- 1 Search XSS non-permanent 2 preview XSS non-permanent 3 Admin login XSS non-permanent 4 Outro --------------------NM--...

CVE-2006-6506

The "Feed Preview" feature in Mozilla Firefox 2.0 before 2.0.0.1 sends the URL of the feed when requesting favicon.ico icons, which results in a privacy leak that might allow feed viewing services to determine browsing habits...

CVE-2006-6506

The "Feed Preview" feature in Mozilla Firefox 2.0 before 2.0.0.1 sends the URL of the feed when requesting favicon.ico icons, which results in a privacy leak that might allow feed viewing services to determine browsing habits...

CVE-2006-6506

The "Feed Preview" feature in Mozilla Firefox 2.0 before 2.0.0.1 sends the URL of the feed when requesting favicon.ico icons, which results in a privacy leak that might allow feed viewing services to determine browsing habits...

CVE-2006-6506: Undefined Security Weakness

The "Feed Preview" feature in Mozilla Firefox 2.0 before 2.0.0.1 sends the URL of the feed when requesting favicon.ico icons, which results in a privacy leak that might allow feed viewing services to determine browsing habits...

RSS Feed-preview referrer leak — Mozilla

Jared Breland reported on LEGROOM.net that when the new "Feed Preview" feature in Firefox 2.0 retrieves the icons of the installed web-based feed viewers it is potentially informing those services of your feed-browsing habits by sending the URL of the feed in a referrer header with each icon...

CVE-2006-6369

SQL injection vulnerability in lib/entryreplyentry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality...

blogsql.txt

Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string ' / 6. Change with this SQL Injection: UNION SELECT b.entryid, b.blogid, b.categoryid, b.entryauthorid, b.entryauthorname,...

Invision Community Blog Mod 1.2.4 - SQL Injection

Invision Community Blog Mod 1.2.4 - SQL Injection 1. Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string ' / 6. Change with this SQL Injection: UNION SELECT b.entryid, b.blogid...