Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2006-2795: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2006-1787: Undefined Security Weakness

Adobe Document Server for Reader Extensions 6.0 includes a user's session jsession ID in the HTTP Referer header, which allows remote attackers to gain access to PDF files that are being processed within that session...

CVE-2006-0846: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Leif M. Wright's Blog 3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 Referer and 2 User-Agent HTTP headers, which are stored in a log file and not sanitized when the administrator views the "Log" page, possibly usin...

CVE-2005-4711

Neocrome Land Down Under (LDU) 801 is affected by CVE-2005-4711: SQL injection via input from the HTTP Referer header. The issue allows remote attackers to execute arbitrary SQL commands on the backend database. The Nessus NASL item for LDU_REFERER_SQL_INJECTION.NASL documents that input from the...

CVE-2005-4711: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Neocrome Land Down Under LDU 801 allows remote attackers to execute arbitrary SQL commands via an HTTP Referer header. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0627: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Clever Copy 2.0, 2.0a, and 3.0 allows remote attackers to inject arbitrary web script or HTML via the 1 Referer or 2 X-Forwarded-For headers in an HTTP request, which are not properly handled when the administrator accesses Site Stats...

CVE-2006-0495

Cross-site scripting XSS vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB aka MyBulletinBoard 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header $url variable...

CVE-2006-0495

The CVE-2006-0495 entry concerns MyBB (MyBulletinBoard) 1.02. A Cross‑Site Scripting (XSS) flaw exists in the Add Thread to Favorites feature implemented in usercp2.php, exploitable via an HTTP Referer header (the $url variable). This allows remote attackers to inject arbitrary web script or HTML...

CVE-2006-0495

Cross-site scripting XSS vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB aka MyBulletinBoard 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header $url variable...

CVE-2006-0495: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB aka MyBulletinBoard 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header $url variable...

CVE-2005-4711

SQL injection vulnerability in Neocrome Land Down Under LDU 801 allows remote attackers to execute arbitrary SQL commands via an HTTP Referer header. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

httpd cross-site scripting flaw in mod_imap

Cross-site scripting XSS vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps...

DEBIAN-CVE-2005-3352

Cross-site scripting XSS vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps...

JVN#15243167 Problem with referer header handling on mobile phone web browsers

Impact Referer information may be unintendedly sent to a server under certain operating conditions. Solution Products Affected For more information, refer to the vendors' websites...

CVE-2005-2853: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in GuppY 4.5.3a and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the pg parameter to printfaq.php, or the 2 Referer or 3 User-Agent HTTP headers, which are not properly handled by error.php...

CVE-2005-1894

Direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request, which causes the code to be injected into referer.php, which can then be accessed by the attacker...

CVE-2005-1894

Direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request, which causes the code to be injected into referer.php, which can then be accessed by the attacker...

CVE-2005-1894

Direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing code into the Referer header, which is injected into referer.php. Affected software: FlatNuke 2.5.3. Root cause: unsafely handling the Referer header leads to code execution. Imp...

CVE-2005-1894: Improper Control of Generation of Code

Direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request, which causes the code to be injected into referer.php, which can then be accessed by the attacker...