222 matches found
Nginx security vulnerability (CVE-2 0 1 3-4 5 4 7)-vulnerability warning-the black bar safety net
Nginx security restrictions might be some requests to ignore, when we for example, by the following manner for URL access restrictions, if an attacker uses some didn't after the escaped space character invalid HTTP Protocol, but from the Nginx 0.8.41 start considering compatibility issues to be...
$_GET not cleaned when parsed from REQUEST_URI
When none of the default methods of determining the request URI have succeeded, the framework will fallback to parsing the raw request URI as passed by the webserver. If this URI has a query string, it will be parsed and $GET will be updated. In this process, the $GET variables are not cleaned,...
reflected xss in the pageId request parameter in 500page.jsp
A scanner picked up that the pageId parameter in 500page.jsp is a potentially reflected xss bug. This can be exploited through a url like the following: https://example.com/pages/viewtrash.vm;editpage?pageId=%22%3E%3Cscript%3Ealert1%3C/script%3E code /images/icons/emoticons/warning.png" You can...
phpBugTracker Multiple Reflected Cross Site Scripting Vulnerabilities
This host is running phpBugTracker and is prone to multiple reflected cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: secpodphpbugtrackermultiplexss.nasl 7029 2017-08-31 11:51:40Z teissa $ phpBugTracker Multiple Reflected Cross Site Scripting Vulnerabilities Authors: Antu...
CVE-2007-5589
Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in 1 PHPSELF in a serverstatus.php, and b grabglobals.lib.php, c displaychangepassword.lib.php, and d common.lib.php in...
CVE-2007-5589
Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in 1 PHPSELF in a serverstatus.php, and b grabglobals.lib.php, c displaychangepassword.lib.php, and d common.lib.php in...
CVE-2007-3328
Multiple cross-site scripting XSS vulnerabilities in Interact 2.4 beta 1 allow remote attackers to inject arbitrary web script or HTML via the 1 modulekey parameter to a kb/kb.php, b quiz/runquiz.php, c quiz/quiz.php, d forum/forum.php, e forum/byname.php, and f journal/journalview.php in modules...
CVE-2007-3328: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in Interact 2.4 beta 1 allow remote attackers to inject arbitrary web script or HTML via the 1 modulekey parameter to a kb/kb.php, b quiz/runquiz.php, c quiz/quiz.php, d forum/forum.php, e forum/byname.php, and f journal/journalview.php in modules...
CVE-2007-3238
CVE-2007-3238 is a cross-site scripting (XSS) vulnerability in the default WordPress theme’s functions.php on WordPress 2.2. It allows remote authenticated administrators to inject arbitrary script/HTML via PATH_INFO (REQUEST_URI) to wp-admin/themes.php. Some configurations may not elevate privil...
CVE-2007-3238
Cross-site scripting XSS vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATHINFO REQUESTURI to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not...
CVE-2007-3240: Undefined Security Weakness
Cross-site scripting XSS vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI REQUESTURI that accesses index.php. NOTE: this can be leveraged for PHP code execution in an administrative session...
Cross site scripting
Cross-site scripting XSS vulnerability in 404.php in Domain Technologie Control DTC before 0.25.9 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO REQUESTURI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...
CVE-2007-3211: Undefined Security Weakness
Cross-site scripting XSS vulnerability in 404.php in Domain Technologie Control DTC before 0.25.9 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO REQUESTURI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...
WordPress Vistered Little Theme - XSS
Because of this vulnerability in 404.php, the attackers can inject arbitrary web script or HTML via the URI REQUESTURI that accesses index.php. Solution Update the theme...
WordPress Core 2.2 - 'Request_URI' Cross-Site Scripting
source: https://www.securityfocus.com/bid/24383/info WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This...
sriweb-xss.txt
XSS found by fl0 fl0w in sri.ro Description: The Romanian Secret Service web site suffers from cross site scripting vulnerability. Author: fl0 fl0w Homepage: http://popesculescu.lx.ro File Size: 5,13 KB site 'search' variable XSS Cross Site Scripting in URI Desciption : This XSS variant usually...
CVE-2006-3848
Cross-site scripting XSS vulnerability in CGI wrapper for IP Calculator IPCalc 0.40 allows remote attackers to inject arbitrary web script or HTML via the URI REQUESTURI environment variable, which is used in the actionurl variable...
CVE-2006-3848: Undefined Security Weakness
Cross-site scripting XSS vulnerability in CGI wrapper for IP Calculator IPCalc 0.40 allows remote attackers to inject arbitrary web script or HTML via the URI REQUESTURI environment variable, which is used in the actionurl variable...
CVE-2006-1499: Undefined Security Weakness
SQL injection vulnerability in vCounter.php in vCounter 1.0 allows remote attackers to execute arbitrary SQL commands via the URI SERVERREQUESTURI variable...
CVE-2005-4221
CVE-2005-4221 concerns an SQL injection in Arab Portal System 2 Beta 2, specifically in link.php. The vulnerability allows remote attackers to inject arbitrary SQL commands via the PHPSESSID (session ID) or the REQUEST_URI (query string). Public references confirm the issue and its CVE entry, but...