Announcement Preview banner is a vector for an XSS attack

The announcement preview banner is currently displayed via the global decorator. It can be used for an XSS attack on virtually every page, via the announcementpreviewbannerst URL parameter. We should display the preview only locally in the admin section...

Announcement Preview banner is a vector for an XSS attack

The announcement preview banner is currently displayed via the global decorator. It can be used for an XSS attack on virtually every page, via the announcementpreviewbannerst URL parameter. We should display the preview only locally in the admin section...

Apple Preview libFontParser SpecialEncoding Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Preview. User interaction is required in that a target must open a malicious file or visit a malicious page. The specific flaw exists within the routine TType1ParsingContext::SpecialEncoding...

Previewing RSA Conference 2010

Dennis and Ryan preview the RSA Conference 2010 with their friend Tim Whitman, the head of the security practice at Schwartz Communications. Subscribe to the News Wrap podcast on Podcast audio courtesy of The New Radio Tough Road Ahead for Adobe on Security...

Gnome Nautilus code execution

HTML script is executed in local machine context on HTML prveiew...

GNOME Nautilus

According to the GNOME documentations, the file manager Nautilus is able to display a preview of most of the files. ref: http://library.gnome.org/users/user-guide/stable/gosnautilus-60.html.en This is a Proof Of Concept, it works using the default settings Local Files Only checked. ++++ BEGIN...

CVE-2003-1578

Sun ONE aka iPlanet Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to hide HTTP requests from the log-preview functionality by accompanying the requests with crafted DNS responses specifying a domain name beginning...

CVE-2003-1578

The CVE-2003-1578 entry concerns Sun ONE (iPlanet) Web Server 4.1–SP12 and 6.0–SP5 when DNS resolution is enabled for client IPs. The underlying issue, described as an Inverse Lookup Log Corruption (ILLC) vulnerability, allows remote attackers to hide HTTP requests from the log-preview functional...

CVE-2003-1578

Sun ONE aka iPlanet Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to hide HTTP requests from the log-preview functionality by accompanying the requests with crafted DNS responses specifying a domain name beginning...

CentOS 5 : ecryptfs-utils (CESA-2009:1307)

Updated ecryptfs-utils packages that fix a security issue, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. eCryptfs is a stacked, cryptographic file system. It is...

iGaming CMS v1.5 CSRF Vulnerability

Exploit for unknown platform in category web applications =================================== iGaming CMS v1.5 CSRF Vulnerability =================================== NeX of the HackTalk team has found a CSRF Vulnerability in iGaming CMS v 1.5 that allows an attacker to make new administrative...

RedHat Security Advisory RHSA-2009:1585

The remote host is missing updates announced in advisory RHSA-2009:1585. Samba is a suite of programs used by machines to share files, printers, and other information. These samba3x packages provide Samba 3.3, which is a Technology Preview for Red Hat Enterprise Linux 5. These packages cannot be...

Sql injection

SQL injection vulnerability in students.php in BPowerHouse BPStudents 1.0 allows remote attackers to execute arbitrary SQL commands via the test parameter in a preview action...

CVE-2009-3437

Cross-site scripting XSS vulnerability in the live preview feature in the Markdown Preview module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via "Markdown input."...

Cross site scripting

Cross-site scripting XSS vulnerability in the live preview feature in the Markdown Preview module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via "Markdown input."...

CVE-2009-3437

Cross-site scripting XSS vulnerability in the live preview feature in the Markdown Preview module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via "Markdown input."...

CVE-2009-3437

The CVE-2009-3437 entry describes a Cross-site Scripting (XSS) vulnerability in Drupal’s Markdown Preview module (live preview feature), version 6.x. The underlying issue allows remote attackers to inject arbitrary web script or HTML via the Markdown input in the live preview. Documents confirm t...

SuSE 11 Security Update : KVM (SAT Patch Number 1166)

The KVM technology available as Technical Preview in SUSE Linux Enterprise has been updated to version 0.10.5. While a minor security issue was fixed, this mainly is a huge version update. Changelog : - 'info chardev' monitor command - automatic port allocation for vnc and similar - improved cdro...

SA-CONTRIB-2009-061 - Markdown Preview - Cross Site Scripting

The Markdown Preview module provides a live preview pane that displays the rendered HTML output of your Markdown input. When displaying the live preview, the module does not properly escape user entered data, leading to a cross-site scripting XSS vulnerability. Such an attack may lead to a...

SA-CONTRIB-2009-055 - BUEditor - Cross Site Scripting

The BUEditor module provides a plain textarea editor designed to facilitate code writing. The module suffers from a Cross Site Scripting XSS vulnerability, which allows an attacker to hijack the account of a logged in user by tricking them into visiting a seemingly innocent page using the Live...