WebSVN 2.0 - Cross-Site Scripting File Handling Code Execution

WebSVN 2.0 - Cross-Site Scripting File Handling Code Execution WebSVN alertdocument.cookie; A url like the one above would display a JavaScript alert window containing the cookie data of any set cookies for the domain. File Handling Issues: There are some file handling issues in the RSS...

WebSVN <= 2.0 (XSS/FH/CE) Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ========================================================= WebSVN alertdocument.cookie; A url like the one above would display a JavaScript alert window containing the cookie data of any set cookies for the domain. File Ha...

WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution

WebSVN alertdocument.cookie; A url like the one above would display a JavaScript alert window containing the cookie data of any set cookies for the domain. File Handling Issues: There are some file handling issues in the RSS functionality used by WebSVN. The issue is caused by the following bit o...

CVE-2008-4667

Directory traversal vulnerability in rss.php in ArabCMS 2.0 beta 1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the rss parameter...

Directory traversal

Directory traversal vulnerability in rss.php in ArabCMS 2.0 beta 1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the rss parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Bitweaver 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to 1 edit.php and 2 list.php in articles/; 3 listblogs.php and 4 rankings.php in blogs/; 5 calendar/index.php; 6 calendar.php, 7 index.php, and 8...

[SECURITY] Fedora 8 Update: liferea-1.4.15-4.fc8

Liferea Linux Feed Reader is an RSS/RDF feed reader. It's intended to be a clone of the Windows-only FeedReader. It can be used to maintain a list of subscribed feeds, browse through their items, and show their contents...

[SECURITY] Fedora 8 Update: evolution-rss-0.0.8-12.fc8

This is an evolution plugin which enables evolution to read rss feeds...

[SECURITY] Fedora 8 Update: blam-1.8.3-18.fc8

Blam is a tool that helps you keep track of the growing number of news feeds distributed as RSS. Blam lets you subscribe to any number of feeds and provides an easy to use and clean interface to stay up to date...

[SECURITY] Fedora 9 Update: evolution-rss-0.1.0-3.fc9

This is an evolution plugin which enables evolution to read rss feeds...

[SECURITY] Fedora 9 Update: blam-1.8.5-2.fc9

Blam is a tool that helps you keep track of the growing number of news feeds distributed as RSS. Blam lets you subscribe to any number of feeds and provides an easy to use and clean interface to stay up to date...

多款RSS阅读器出现XSS漏洞

IE和OPERA对RSS中item下的description标签内容，解析过程如下： 首先使用HTML编码对内容解密（例：‘’解析为‘’），之后执行其中HTML代码。 这种解析方式导致一些RSS阅读工具对此过滤不严，出现XSS漏洞。 INTERNET EXPLORER ver= IE7 OPERA ver =9.52 新浪点点通1.1.0.8 目前最高 周博通4.028031409 目前最高 遨游2.1.4.443（目前最高） RSS侧边栏 等待厂商升级 在description标签的内容中输入HTML编码后的JS代码，例如： ?xml version="1.0"...

XSS in RSS feed creation

URL http://localhost:8080/dashboard/doconfigurerssfeed.action The RSS feed creation process is vulnerable to XSS attacks. It is possible to inject javascript code into the page by changing the types field to: types="alertdocument.cookie complete example from the testenvironment:...

XSS in RSS feed creation

URL http://localhost:8080/dashboard/doconfigurerssfeed.action The RSS feed creation process is vulnerable to XSS attacks. It is possible to inject javascript code into the page by changing the types field to: types="alertdocument.cookie complete example from the testenvironment:...

XSS in RSS feed creation

URL http://localhost:8080/dashboard/doconfigurerssfeed.action The RSS feed creation process is vulnerable to XSS attacks. It is possible to inject javascript code into the page by changing the types field to: types="alertdocument.cookie complete example from the testenvironment:...

Be careful Baidu blog rss leak your blog secrets-the vulnerability warning-the black bar safety net

If you apply for a Baidu blog, then in Settings-Display Options-article display options for full-text or summary, then you want to hide the articles through the rss to be seen. For the time being the solution is: Settings--Display Options--article display options to the title, so bad intentions o...

CVE-2008-3503

RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System CS RSS feeds, which allows remote attackers to obtain sensitive information CS data...

CVE-2008-3503

Plain Black WebGUI prior to 7.5.13 has an RSSFromParent flaw that does not restrict CS RSS feed view access, enabling remote disclosure of Collaboration System data. A fix is available in 7.5.13 (beta released) and later versions; upgrade to mitigate. Technical details: affected product/component...

Gregarius ajax.php文件SQL注入漏洞

BUGTRAQ ID: 30423 Gregarius是基于php的RSS聚合器，可以将所设定的源聚合在一起，以HTML或者XML方式输出。 Gregarius的/ajax.php文件中存在多个SQL注入漏洞，允许远程攻击者无需认证便可获得管理凭据。以下是有漏洞的代码段： function expgetFeedContent$cid obstart; rssrequire'cls/items.php'; $readItems = new ItemList; $readItems - populate" noti.unread & ". RSSMODEUNREADSTATE ." and...

plugin Rss Remote File Inclusion Vulnerability

plugin Rss Remote File Inclusion Vulnerability Ghost Hacker, http://gh0st10.wordpress.com |, .-. .-. ,| | o/ o | R-H team |/ / | Found by : Ghost Hacker HomePage : real-hack.net Email : [email protected] Name Script : plugin Rss Download Script :...