5662 matches found
osCommerce 2.2 - Contact_us.php Cross-Site Scripting
osCommerce 2.2 - Contactus.php Cross-Site Scripting source: https://www.securityfocus.com/bid/12568/info A vulnerability is reported to exist in osCommerce that may allow a remote user to launch cross-site scripting attacks. This issue could permit a remote attacker to create a malicious URI link...
CVE-2004-0866
Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session...
CVE-2005-0265
Multiple SQL injection vulnerabilities in browse.php in OWL 0.7 and 0.8 allow remote attackers to execute arbitrary SQL commands via the 1 parent or 2 sortposted parameter...
Microsoft Windows SharePoint Services Cross-Site Scripting and Spoofing Vulnerability
Description A cross-site scripting and spoofing vulnerability affects Microsoft Windows SharePoint Services and SharePoint Team Services. A remote attacker may carry out a cross-site scripting attack to execute arbitrary HTML and script code in a user's browser. It is also possible to poison Web...
[SECURITY] [DSA 669-1] New php3 packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 669-1 [email protected] http://www.debian.org/security/ Martin Schulze February 7th, 2005 http://www.debian.org/security/faq -...
CVE-2005-0231
Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."...
CVE-2005-0174
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including 1 multiple Content-Length headers, 2 carriage return CR characters that are not part of a CRLF pair, and 3 header names containing...
[EXPL] TinyWeb Server DoS Exploit
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...
CVE-2005-0127
Mail in Mac OS X 10.3.7, when generating a Message-ID header, generates a GUUID that includes information that identifies the Ethernet hardware being used, which allows remote attackers to link mail messages to a particular machine...
Exponent CMS Multiple Script pathos_core_version Parameter Path Disclosure
The remote host is running Exponent, a web-based content management system implemented in PHP. Directly requesting several different pages reveals the absolute path where Exponent is installed. A remote attacker could use this information to mount further attacks. In addition, the installed versi...
CVE-2004-1005
Multiple buffer overflows in Midnight Commander mc 4.5.55 and earlier allow remote attackers to have an unknown impact...
CVE-2004-1092
Midnight commander mc 4.5.55 and earlier allows remote attackers to cause a denial of service by causing mc to free unallocated memory...
DEBIAN-CVE-2004-1184
The EPSF pipe support in enscript 1.6.3 allows remote attackers or local users to execute arbitrary commands via shell metacharacters...
CVE-2004-1357
The Secure Shell SSH Daemon SSHD in Sun Solaris 9 does not properly log IP addresses when SSHD is configured with the ListenAddress as 0.0.0.0, which makes it easier for remote attackers to hide the source of their activities...
CVE-2005-0110
Internet Explorer 6 on Windows XP SP2 allows remote attackers to bypass the file download warning dialog and possibly trick an unknowledgeable user into executing arbitrary code via a web page with a body element containing an onclick tag, as demonstrated using the createElement function...
CVE-2004-1209
Verisign Payflow Link, when running with empty Accepted URL fields, does not properly verify the data in the hidden AMOUNT field, which allows remote attackers to modify the price of the items that they purchase...
CVE-2004-0914
Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include 1 multiple integer overflows, 2 out-of-bounds memory accesses, 3 directory traversal, 4 shell metacharacter, 5 endless loops, and 6 memory leaks, which could allow remote attackers to obtain...
CVE-2004-1318
Cross-site scripting XSS vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab "%09" character, which prevents the rest of the query from being properly sanitized...
CVE-2004-1459
Cisco Secure Access Control Server ACS 3.2, when configured as a Light Extensible Authentication Protocol LEAP RADIUS proxy, allows remote attackers to cause a denial of service device crash via certain LEAP authentication requests...