Sage cross-context scripting -> LOCAL-CONTEXT SCRIPTING

Correct me if I'm wrong but the following description from http://www.securityfocus.com/bid/19928/discuss is wrong: "Attacker-supplied HTML and script code would execute in the context of the affected website" Code is NOT executed within the context of the affected site but rather within LOCAL...

[Full-disclosure] RSS Injection in Sage part 2

RSS Injection is Sage part 2 2 months ago, both pdp and myself released a vulnerability and proof of concept exploit for Sage. see: http://michaeldaw.org/md-hacks/cross-context-scripting-with-sage/. This issue was resolved in Sage release 1.3.7 http://mozdev.org/bugs/showbug.cgi?id=15101. I found...

articleSQL.txt

Article Script v1.and v1.6.3 Sql injection Script Name :Article Script Home Page:www.articlescript.org Bug Founder :Liz0ziM Mail:[email protected] Baba Kimdir? Tabiki Liz0ziM ------------------------------------------------------------ http://www.victim.com/articles/rss.php?category= ' sql İnjecti...

PT-2006-6446 · Unknown · Article Script

Name of the Vulnerable Software and Affected Versions: Article Script versions 1.6.3 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the category parameter in the rss.php file. Recommendations: For Article Script versions 1.6.3 an...

CVE-2006-5588: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in CMS Faethon 2.0 Ultimate and earlier, when registerglobals and magicquotesgpc are enabled, allow remote attackers to execute arbitrary PHP code via a URL in the mainpath parameter to 1 includes/rss-reader.php or 2 admin/config.php, different...

Firefox Sage扩展RSS Feed脚本注入漏洞

sage是Firefox的一个灵巧的RSS和Atom feed聚合扩展。 sage在处理RSS feed中的内容标签时存在输入验证错误，远程攻击者可能利用此漏洞在用户机器上执行恶意代码。 如果用户受骗添加了恶意的RSS feed并浏览了其内容的话，就会导致在本地环境中注入并执行任意HTML和脚本代码。 Mozine Sage 1.3.6 厂商补丁： Mozine ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://addons.mozine.org/extensions/moreinfo.php?id=12%22...

CMS Faethon <= 2.0 (mainpath) Remote File Include Exploit

No description provided by source. !/usr/bin/perl CMS Faethon 2.0 Ultimate Class: Remote/Local File Include Vulnerability Date: 2006/10/24 Remote: Yes Type: Highly critical Vendor: www.cmsfaethon.org...

CVE-2006-5475

Multiple cross-site scripting XSS vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or HTML via a crafted RSS feed...

CVE-2006-5475

Multiple cross-site scripting XSS vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or HTML via a crafted RSS feed...

CMS Faethon 2.0 - 'mainpath' Remote File Inclusion

!/usr/bin/perl CMS Faethon 2.0 Ultimate Class: Remote/Local File Include Vulnerability Date: 2006/10/24 Remote: Yes Type: Highly critical Vendor: www.cmsfaethon.org Download: http://cmsfaethon.org/downloads/...

CVE-2006-5475: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or HTML via a crafted RSS feed...

[DRUPAL-SA-2006-024] Drupal 4.6.10 / 4.7.4 fixes multiple XSS issues

------------------------------------------------------------------------ ---- Drupal security advisory DRUPAL-SA-2006-024 ------------------------------------------------------------------------ ---- Project: Drupal core Date: 2006-Oct-18 Security risk: Moderately critical Exploitable from: Remot...

FreeBSD : drupal -- multiple XSS vulnerabilities (b2383758-5f15-11db-ae08-0008743bf21a)

The Drupal Team reports : A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS attack via a specially crafted RSS feed. This...

DRUPAL-SA-2006-024 - Drupal core - Multiple cross site scripting vulnerabilities

Multiple XSS cross site scripting vulnerabilities have been discovered. A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS...

drupal -- multiple XSS vulnerabilities

The Drupal Team reports: A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS attack via a specially crafted RSS feed. This...

Debian DSA-944-1 : mantis - several vulnerabilities

Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-4238 Missing input sanitising allows remote attackers to inject arbitrary web script or HTML. -...

SharpReader < 0.9.7.1 RSS Feed XSS (deprecated)

Binary data 3748.prm...

FeedDemon < 2.0.0.25 Atom Feed Active Script Code Execution

According to the Windows registry, the version of FeedDemon, an RSS reader for Windows, installed on the remote host is affected by a flaw due to improper sanitization of RSS feeds of Active Script code. An attacker can exploit this issue to inject arbitrary script into the affected application,...

CVE-2006-4829: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in David Czarnecki Blojsom 2.31 allow remote attackers to inject arbitrary web script or HTML via the 1 blog-category-description, 2 blog-entry-title, 3 rss-enclosure-url, 4 technorati-tagsi, or 5 blog-category-name parameter in a blog post...

CVE-2006-4762

Multiple cross-site scripting XSS vulnerabilities in Ykoon RssReader allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test suite...