CVE-2006-4712

Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...

CVE-2006-4712

Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...

CVE-2006-4712

CVE-2006-4712 affects Sage 1.3.6 and describes multiple XSS vulnerabilities in which remote attackers can inject arbitrary script via a content:encoded element in an RSS feed, demonstrated by four content:encoded elements that use XMLHttpRequest to read local files (Cross Context Scripting). The ...

CVE-2006-4712

Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...

CVE-2006-4712: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...

MagpieRSS (a simple RSS integration tool) Full path vul

Hello MagpieRSS a simple RSS integration tool Full path vul magpierss/rssfetch.inc.php magpierss/rssparse.inc.php...

CVE-2006-4660

Multiple cross-site scripting XSS vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll allow remote attackers to process arbitrary web script or HTML in the Feeds interface context via the 1 title and 2 description elements within an item element in an...

CVE-2006-4660

CVE-2006-4660 concerns multiple XSS vulnerabilities in the RSS Feed module of AOL ICQ Toolbar 1.3 for Internet Explorer. The weaknesses arise from the RSS feed item fields (title and description) being appended to HTML output without sanitization, enabling remote attackers to execute arbitrary sc...

CVE-2006-4660: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll allow remote attackers to process arbitrary web script or HTML in the Feeds interface context via the 1 title and 2 description elements within an item element in an...

CVE-2006-4660

Multiple cross-site scripting XSS vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll allow remote attackers to process arbitrary web script or HTML in the Feeds interface context via the 1 title and 2 description elements within an item element in an...

Multiple ICQ Toolbar vulnerabilities

RSS crossite scripting, web configuration interface remote control...

CORE-2006-0322: Multiple vulnerabilities in ICQ Toolbar 1.3 for Internet Explorer

Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Multiple vulnerabilities in ICQ Toolbar 1.3 for Internet Explorer Date Published: 2006-09-07 Last Update: 2006-09-06 Advisory ID: CORE-2006-0322 Bugtraq ID: None currently assigned CVE Name: None currently assign...

CVE-2006-4551

Eval injection vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to execute arbitrary PHP code via 1 the file specified as the value of the format parameter, and possibly 2 the RSS feed...

CVE-2006-4552

Cross-site scripting XSS vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to inject arbitrary web script or HTML via the RSS feed...

CVE-2006-4551

Eval injection vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to execute arbitrary PHP code via 1 the file specified as the value of the format parameter, and possibly 2 the RSS feed...

CVE-2006-4552: Undefined Security Weakness

Cross-site scripting XSS vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to inject arbitrary web script or HTML via the RSS feed...

CVE-2006-4551: Undefined Security Weakness

Eval injection vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to execute arbitrary PHP code via 1 the file specified as the value of the format parameter, and possibly 2 the RSS feed...

CVE-2006-4552

The CVE-2006-4552 entry concerns CHXO Feedsplitter (RSS/RDF feed converter) with a cross-site scripting flaw. The Feedsplitter component (feedsplitter.php) processes the format parameter when parsing an XML feed, and improper validation allows a remote attacker to inject arbitrary script via a fe...

CVE-2006-4552

Cross-site scripting XSS vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to inject arbitrary web script or HTML via the RSS feed...

feedsplitter considered harmful

I was looking through the feedsplitter.php script avaiable from http://chxo.com/software/feedsplitter/, version 2006-01-21 revision 1.7 according to the RCS $Id$, but that looks out of date today, and noticed a few problems. Background: feedsplitter turns RSS feeds into HTML or javascript so you...