60 matches found
Citrix Access Gateway information leak
HTTP session cookie is passed through HTTP GET request parameters, making it possible to leak it value thorugh Referer: field or in the browsing history...
WordPress自动统计模块Referer字段HTML注入漏洞
WordPress是一款基于WEB的BLOG系统。 基于WordPress上的自动统计模块不正确处理用户提交的输入，远程攻击者可以利用漏洞进行HTML注入攻击，获得敏感信息。 问题是由于不正确过滤用户生成的HTTP头字段中的Referer参数数据，提交恶意的HTTP数据，并诱使用户访问，可导致获得目标用户敏感信息。 Skeltoac Automattic Stats 1.0 可联系供应商获得补丁信息： http://wordpress.org/extend/plugins/stats/ GET http://www.somewpblog.com/ HTTP/1.1...
Cross site scripting
Cross-site scripting XSS vulnerability in the skeltoac stats Automattic Stats 1.0 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer field...
CVE-2006-4798
SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...
CVE-2006-4798
SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...
CVE-2006-4798
SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...
CVE-2006-4798: Undefined Security Weakness
SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...
CVE-2006-2634
Cross-site scripting XSS vulnerability in Neocrome Land Down Under LDU in Neocrome Seditio 102 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer field...
CVE-2005-4015
CVE-2005-4015 affects PHP Web Statistik 1.4. The issue is that the log database is not rotated and the referer field size is not limited, enabling a remote attacker to exhaust log files by issuing a very high number of HTTP requests (demonstrated via pixel.php). The available references describe ...
CVE-2004-1841: Undefined Security Weakness
SQL injection vulnerability in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL via the referer field in an HTTP request...
CVE-2004-1578
Cross-site scripting XSS vulnerability in index.php in Invision Power Board 2.0.0 allows remote attackers to execute arbitrary web script or HTML via the Referer field in the HTTP header...
CVE-2004-1578
The CVE-2004-1578 entry concerns Invision Power Board 2.0.0 with a cross-site scripting (XSS) vulnerability in index.php that allows an attacker to inject arbitrary web script or HTML via the Referer header in HTTP requests. Documented impact from sources like NVD and CVE lists is that remote att...
CVE-2005-0302: Undefined Security Weakness
SQL injection vulnerability in default.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to execute arbitrary SQL commands via the referer field in the HTTP header...
CommuniGate Pro < 4.0 .1b2 Referer Field Hijacking
Binary data 1552.prm...
CVE-2003-1481
CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer...
Authentication data leak in Congueror
Referer: field may contain URL with authentication data...
Session Hijacking in CommunigatePro
In webmail interface session identifier is passed to server as a part of GET requiest, thouse may be discovered by third party via Referer: field...
CommuniGatePro 4.0.6 [EXPLOIT]
Vulnerability in CommuniGatePro webmail under some circumstances may allow attacker to get access to users mailbox. Object: CommuniGatePro version 4.0.6 and earlier. Not vulnerable according to Stalker.com 4.1b2 with UseCookies option Vendor: Stalker Software Inc. www.stalker.com Description:...