CVE-2008-4305: Improper Control of Generation of Code

Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI...

CVE-2008-5264

The CVE-2008-5264 entry documents a Cross-site scripting (XSS) flaw in Tornado Knowledge Retrieval System versions 4.2 and earlier, affecting the searcher.exe component via the p parameter in a root action. Public sources do not provide additional exploit details, proof-of-exploit, affected versi...

CVE-2008-5214

CVE-2008-5214 refers to a cross-site scripting (XSS) vulnerability in ClanLite. The affected component is the web page calendrier.php ( ClanLite 2.2006.05.20 ), with the annee parameter enabling remote attackers to inject arbitrary web script or HTML. OpenVAS additionally flags potential SQL inje...

CVE-2008-5068

Multiple cross-site scripting XSS vulnerabilities in Kmita Gallery allow remote attackers to inject arbitrary web script or HTML via the 1 begin parameter to index.php and the 2 searchtext parameter to search.php. NOTE: the provenance of this information is unknown; the details are obtained solel...

CVE-2008-4818

CVE-2008-4818 is an XSS in Adobe Flash Player related to how HTTP response headers are interpreted. The vulnerability affects Flash Player 9.0.124.0 and earlier. In Red Hat advisories, fixes are delivered via flash-plugin updates: RHSA-2008-0980 for older RHEL3/4/others (updating to Flash Player ...

CVE-2008-4775

Cross-site scripting XSS vulnerability in pmdpdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and...

KLA10240 CI vulnerability in Kontiki DMS

An XSS vulnerability was found in Kontiki DMS. By exploiting this vulnerability malicious users can inject arbitrary web script. This vulnerability can be exploited remotely via a specially designed call. Original advisories - Exploitation Public exploits exist for this vulnerability. CVE list...

CVE-2008-3664

Multiple cross-site scripting XSS vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTML via 1 the real name field, related to the user list; 2 the target parameter to login.php, 3 the title parameter to activities/some.php, 4 the companyname parameter to...

FreeBSD Ports: phpmyadmin, phpMyAdmin

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: phpmyadmin, phpMyAdmin

The remote host is missing an update to the system as announced in the referenced advisory. VID 882ef43b-901f-11d9-a22c-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: squirrelmail, ja-squirrelmail

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Code injection

Swfdec 0.6 before 0.6.8 allows remote attackers to cause a denial of service application crash via a 1x1 JPEG image...

CVE-2008-3482

Cross-site scripting XSS vulnerability in the error page feature in Panasonic Network Camera BL-C111, BL-C131, BB-HCM511, BB-HCM531, BB-HCM580, BB-HCM581, BB-HCM527, and BB-HCM515 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-3422

Multiple cross-site scripting XSS vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to 1 HtmlControl.cs PreProcessRelativeReference, 2 HtmlForm.cs RenderAttributes, 3 HtmlInputButton...

CVE-2008-3379

CVE-2008-3379 affects Snark VisualPic 0.3.1 and is a cross-site scripting (XSS) vulnerability. The issue arises from insufficient input sanitization of the pic parameter in the default URI, allowing remote attackers to inject arbitrary web script/HTML that executes in the victim’s browser. The vu...

CVE-2008-3334

Cross-site scripting XSS vulnerability in MyBB 1.2.x before 1.2.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving search.php...

CVE-2008-3198

Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933...

CVE-2008-2997

CVE-2008-2997 : XSS vulnerability in Gravity Board X (GBX) 2.0 Beta. In GBX’s index.php, the subject parameter in the postnewsubmit (create new thread) action can be exploited to inject arbitrary script/HTML. This remote vector could affect users who submit a thread, with the impact described as ...

CVE-2008-2462

Cross-site scripting XSS vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

Google Talk http和mailto远程代码注入漏洞

BUGTRAQ ID: 29946 Google Talk是一款流行的即时通讯软件，允许直接与其他的计算机用户进行语音对话。 GTalk没有正确地验证用户在聊天对话窗口中所提交的http和mailto，如果可信任的联系人在对话窗口中提交了特制的URL或mailto地址的话，就会导致在对方的机器上注入并执行HTML代码，或执行跨站脚本攻击。 Google Talk 1.0.0.105 Google ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.google.com http://"h1Lostmon/h1...