1227 matches found
Project name that contains double-quote is not properly escaped on Issue Navigator page
If a project has a double-quote in its name, it's not xml-escaped when used in "title" attribute. For example, if we have a project named 14" monitors, the html will look like: 14" monitors This causes JIRA Client to hiccup on this page and lose a lot of functionality. On web browser, the title i...
esmart-bypass.txt
Aria-Security Team http://aria-security.net -------------------------------------- Vendor :http://www.preproject.com Script/Portal: E-SMART CART You can bypass the login page with: ' or ' Shouts :theoutl4w...
tomcat handling of cookies
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...
Cross site scripting
Cross-site scripting XSS vulnerability in Mozilla Firefox before 2.0, when UTF-7 document content is rendered directly in UTF-7, allows remote attackers to inject arbitrary web script or HTML via a gopher URI that uses single quote characters to delimit a literal string within an XSS sequence, a...
tomcat handling of cookie values
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...
Apache Tomcat fails to properly handle cookies containing single quotes
Overview Apache Tomcat fails to properly handle cookies that contain a single quote, which may allow session hijacking. Description Apache Tomcat is an implementation of the Java Servlet and JavaServer Page JSP technologies. Apache Tomcat incorrectly treats a single quote as a cookie delimiter...
WF-Quote 1.0 Xoops Module - index.php SQL Injection
WF-Quote 1.0 Xoops Module - index.php SQL Injection source: https://www.securityfocus.com/bid/23845/info The WF-Quote module for the Xoops CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this...
WF-Quote 1.0 Xoops Module - 'index.php' SQL Injection
source: https://www.securityfocus.com/bid/23845/info The WF-Quote module for the Xoops CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...
CVE-2007-0517
Scriptsez Random PHP Quote 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password information via a direct request for pwd.txt...
CVE-2007-0517
Scriptsez Random PHP Quote 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password information via a direct request for pwd.txt...
Cross site scripting
Cross-site scripting XSS vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the ordernum parameter...
CVE-2007-0144
Cross-site scripting XSS vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the ordernum parameter...
CVE-2007-0144
The CVE-2007-0144 entry documents a Cross-site scripting (XSS) vulnerability in search.asp of Digitizing Quote And Ordering System 1.0. The issue allows remote authenticated attackers to inject arbitrary web script or HTML via the ordernum parameter. The NVD notes a MEDIUM base score (6.8) with n...
CVE-2006-6911
SQL injection vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated users to execute arbitrary SQL commands via the ordernum parameter...
CVE-2007-0144
Cross-site scripting XSS vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the ordernum parameter...
CVE-2007-0106
Cross-site scripting XSS vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when...
igcal10-sql.txt
SQL Injection in ig-Calendar. This works regardless of magicquotesgpc! Dumps mysql login informaion: http://127.0.0.1/ig-calendar/user.php?id=999%20union%20select%201,User,Password,Host,Filepriv,0%20from%20mysql.user ./user.php line 52: $query = 'SELECT FROM users WHERE id='.$id; Should have used...
CVE-2006-6911
SQL injection vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated users to execute arbitrary SQL commands via the ordernum parameter...
security flaw
Buffer overflow in the mailvalidnetparsework function in mail.c for Washington's IMAP Server UW-IMAP before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote " character without a closing quote, which causes bytes after the double-quo...