67 matches found
Microsoft SharePoint SafeHTML Information Disclosure Vulnerabilities (2412048)
This host is missing an important security update according to Microsoft Bulletin MS10-072. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Preemptive Protection against Microsoft Internet Explorer SafeHTML Cross-Site Scripting (MS11-074)
An information disclosure vulnerability has been reported in Internet Explorer. A remote attacker may exploit this vulnerability to perform cross-site scripting attacks and run script in the security context of the logged-on user...
CVE-2011-1252
Cross-site scripting XSS vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint...
CVE-2011-1252
CVE-2011-1252 corresponds to a cross-site scripting vulnerability in the toStaticHTML SafeHTML function used by Internet Explorer 7/8 and several Microsoft SharePoint-related products (SharePoint Server 2007 SP2, SharePoint Server 2010 SP1, Groove Server 2010, Windows SharePoint Services 3.0 SP2,...
CVE-2010-3243: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified...
Microsoft Sharepoint SafeHTML crossite scripting
Few crossite scripting possibilities...
CVE-2010-3324: Improper Neutralization of Input During Web Page Generation
The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scriptin...
JForum 2.08 Cross Site Scripting
Minded Security Labs: Advisory MSA130510 JForum ?s?i\color='"?.?^'"'"?.?/color\ $2 As it's possible to see from the previous code, "color" attribute expects a parameter between single quotes. Jforum does not encode single quotes, so it's possible to a...
[SA16427] SafeHTML UTF-7 XSS and CSS Comments Handling Security Bypass
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
SafeHTML content filtering bypass
It's possible to bypass content filtering by using UTF-7 encoding...
CVE-2005-2608
CVE-2005-2608 concerns SafeHTML prior to version 1.3.5, where the library fails to properly filter script in UTF-7 and CSS comments, allowing remote XSS in applications that use SafeHTML. Affected component: SafeHTML (pre-1.3.5). Root cause: inadequate filtering of certain UTF-7 and CSS-comment c...
CVE-2005-2608
SafeHTML before 1.3.5 does not properly filter script in UTF-7 and CSS comments, which allows remote attackers to conduct cross-site scripting XSS attacks in vulnerable applications that use SafeHTML...
CVE-2005-2608
SafeHTML before 1.3.5 does not properly filter script in UTF-7 and CSS comments, which allows remote attackers to conduct cross-site scripting XSS attacks in vulnerable applications that use SafeHTML...
CVE-2005-2608: Undefined Security Weakness
SafeHTML before 1.3.5 does not properly filter script in UTF-7 and CSS comments, which allows remote attackers to conduct cross-site scripting XSS attacks in vulnerable applications that use SafeHTML...
CVE-2005-1638
The writeAttrs function in SafeHTML before 1.3.2 does not properly handle quotes in attribute values, which could allow remote attackers to exploit cross-site scripting XSS vulnerabilities in applications that rely on SafeHTML for protection...
CVE-2005-1638
The writeAttrs function in SafeHTML before 1.3.2 does not properly handle quotes in attribute values, which could allow remote attackers to exploit cross-site scripting XSS vulnerabilities in applications that rely on SafeHTML for protection...
CVE-2005-1638
The vulnerability CVE-2005-1638 affects the SafeHTML library, with the _writeAttrs function failing to properly quote attribute values. This mis-handling can enable cross-site scripting (XSS) in applications that rely on SafeHTML for protection. Affected: SafeHTML prior to 1.3.2. Root cause: insu...
CVE-2005-1638: Undefined Security Weakness
The writeAttrs function in SafeHTML before 1.3.2 does not properly handle quotes in attribute values, which could allow remote attackers to exploit cross-site scripting XSS vulnerabilities in applications that rely on SafeHTML for protection...