3058 matches found
Google Talk http和mailto远程代码注入漏洞
BUGTRAQ ID: 29946 Google Talk是一款流行的即时通讯软件，允许直接与其他的计算机用户进行语音对话。 GTalk没有正确地验证用户在聊天对话窗口中所提交的http和mailto，如果可信任的联系人在对话窗口中提交了特制的URL或mailto地址的话，就会导致在对方的机器上注入并执行HTML代码，或执行跨站脚本攻击。 Google Talk 1.0.0.105 Google ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.google.com http://"h1Lostmon/h1...
CVE-2008-2852
CGIWrap before 4.1 is affected by CVE-2008-2852, an XSS due to error messages not specifying a charset. When using Internet Explorer-based browsers, attackers could inject arbitrary HTML/JS via error responses. The OpenVAS/Nessus/VM sources confirm the IE-specific vector and the CGIWrap XSS descr...
vBulletin 3.7.1 PL1 and lower, vBulletin 3.6.10 PL1: XSS in modcp index
====================================================================== Advisory : XSS in modcp index Release Date : June 17th 2008 Application : vBulletin Version : vBulletin 3.7.1 PL1 and lower, vBulletin 3.6.10 PL1 and lower Platform : PHP Vendor URL : http://www.vbulletin.com/ Authors : Jessic...
CVE-2008-2640
CVE-2008-2640 concerns cross-site scripting in Adobe Flex 3 History Management. The vulnerability lies in historyFrame.html (used by Flex 3.0.1 SDK and Flex Builder 3 and generated applications) where user-supplied values are not properly filtered in the anchor identifier, enabling remote attacke...
CVE-2008-2646
Multiple cross-site scripting XSS vulnerabilities in meBiblio 0.4.7 allow remote attackers to inject arbitrary web script or HTML via the 1 sql parameter to dbadd.inc.php, 2 InsertJournal parameter to addjournalmask.inc.php, 3 InsertBibliography parameter to insertmask.inc.php, and 4 LabelYear...
fastfree-rfi.txt
Fast Free Media Script Remote Code Ýnjection Exploit Coded By Liz0ziM Web:www.biyosecurity.com Dork:"Powered by FastFreeMedia.com" & inurl:cat-1-p0.html & inurl:page.php?page=topvids & inurl:page.php?page=topgames TARGET HOST: Example:www.sexwhispers.com TARGET PATH: Example:/ or /scriptpath/ ADM...
CVE-2008-1947
CVE-2008-1947 is an XSS vulnerability in Apache Tomcat, affecting 5.5.9–5.5.26 and 6.0.0–6.0.16. It allows remote attackers to inject arbitrary web script or HTML via the name parameter (the hostname attribute) to host-manager/html/add. The connected documents confirm the affected product/version...
F5 BIG-IP管理接口NEW_VALUE参数远程代码注入漏洞
BUGTRAQ ID: 28639 F5 BIG-IP是集成了网络流量管理、应用程序安全管理器、负载均衡等功能的多合一网络设备。 BIG-IP的配置工具实现上存在输入验证漏洞，远程攻击者可能利用此漏洞在系统上执行任意命令。 Web管理接口和CLI所使用的F5 BIG-IP重新配置工具没有正确地过滤某些重新配置请求，如果登录用户拥有Resource Manager或Administrator权限的话，就可以注入任意Perl代码，生成Unix shell命令并以root用户权限执行。 这个漏洞的起因是未经转义NEWVALUE中的单引号便使用了包含有类似于以下内容模板的Perl EP3：...
Code injection
The Macrovision InstallShield InstallScript One-Click Install OCI ActiveX control 12.0 before SP2 does not validate the DLL files that are named as parameters to the control, which allows remote attackers to download arbitrary library code onto a client machine...
CVE-2008-1621
GeegCarts is affected by CVE-2008-1621 with malicious scripts injectable through the id parameter to show.php, search.php, and view.php. The issue is described as multiple cross-site scripting (XSS) vulnerabilities that could allow remote attackers to inject arbitrary web script or HTML. Affected...
Cross site scripting
Cross-site scripting XSS vulnerability in admin.php in MG2 formerly Minigal allows remote attackers to inject arbitrary web script or HTML via the list parameter in an import action...
CVE-2008-1225
WebCT Campus Edition 4.1.5.8 contains multiple XSS vulnerabilities when “Don’t wrap text” is enabled, allowing remote authenticated users to inject arbitrary script/HTML via a mail message or discussion board message. Root cause is input handling in the discussion/mail features; exploit details a...
CVE-2008-1183
Multiple cross-site scripting XSS vulnerabilities in Crafty Syntax Live Help CSLH before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 livehelp.php, 2 userquestions.php, and 3 leavemessage.php. NOTE: the lostsheep.php vector is covered by...
CVE-2008-0872
Cross-site scripting XSS vulnerability in SmarterTools SmarterMail Enterprise 4.3 allows remote attackers to inject arbitrary web script or HTML via a STYLE attribute of an element in the Subject field of an e-mail message...
CVE-2008-0642
Cross-site scripting XSS vulnerability in files created by Adobe RoboHelp 6 and 7, possibly involving use of a 1 WebHelp5 WebHelp5Ext or 2 WildFire WildFireExt extension, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than...
CVE-2008-0642
CVE-2008-0642 describes a cross-site scripting (XSS) vulnerability in files created by Adobe RoboHelp 6 and 7, potentially involving WebHelp5 (WebHelp5Ext) or WildFire (WildFireExt) extensions. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors and is...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via 1 the viewtype parameter to graph.php; 2 the filter parameter to graphview.php; 3 the action parameter to the drawnavigationtext...
[OPENADS-SA-2008-001] Openads 2.4.2 vulnerability fixed
======================================================================== Openads security advisory OPENADS-SA-2008-001 ------------------------------------------------------------------------ Advisory ID: OPENADS-SA-2008-001 Date: 2008-Feb-04 Security risk: Critical Applications affetced: Openads...