CVE-2006-6919

Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with an img tag containing the script followed by an extra trailing "", which Sage modifies to close the img element before the malicious script...

CVE-2006-6919

The CVE-2006-6919 vulnerability affects the Firefox Sage extension (version 1.3.8 and earlier). An RSS feed containing an img tag with an embedded script and a trailing ">" can be manipulated so Sage closes the img element before the malicious script is executed, enabling remote JavaScript exe...

Sage cross-context scripting -> LOCAL-CONTEXT SCRIPTING

Correct me if I'm wrong but the following description from http://www.securityfocus.com/bid/19928/discuss is wrong: "Attacker-supplied HTML and script code would execute in the context of the affected website" Code is NOT executed within the context of the affected site but rather within LOCAL...

[Full-disclosure] RSS Injection in Sage part 2

RSS Injection is Sage part 2 2 months ago, both pdp and myself released a vulnerability and proof of concept exploit for Sage. see: http://michaeldaw.org/md-hacks/cross-context-scripting-with-sage/. This issue was resolved in Sage release 1.3.7 http://mozdev.org/bugs/showbug.cgi?id=15101. I found...

Firefox Sage扩展RSS Feed脚本注入漏洞

sage是Firefox的一个灵巧的RSS和Atom feed聚合扩展。 sage在处理RSS feed中的内容标签时存在输入验证错误，远程攻击者可能利用此漏洞在用户机器上执行恶意代码。 如果用户受骗添加了恶意的RSS feed并浏览了其内容的话，就会导致在本地环境中注入并执行任意HTML和脚本代码。 Mozine Sage 1.3.6 厂商补丁： Mozine ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://addons.mozine.org/extensions/moreinfo.php?id=12%22...

CVE-2006-4711

Multiple cross-site scripting XSS vulnerabilities in Sage allow remote attackers to inject arbitrary web script or HTML via an Atom 1.0 feed, as demonstrated by certain test cases of the James M. Snell Atom 1.0 feed reader test suite...

CVE-2006-4712

Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...

CVE-2006-4712

Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...

CVE-2006-4712

CVE-2006-4712 affects Sage 1.3.6 and describes multiple XSS vulnerabilities in which remote attackers can inject arbitrary script via a content:encoded element in an RSS feed, demonstrated by four content:encoded elements that use XMLHttpRequest to read local files (Cross Context Scripting). The ...

CVE-2006-4711

The Red Hat CVE and related records confirm CVE-2006-4711 affects Sage with an XSS vulnerability exposed via Atom 1.0 feed handling, allowing remote attackers to inject arbitrary script/HTML. The core detail: XSS in Sage’s Atom 1.0 feed processing (as evidenced by Red Hat entry and similarly word...

CVE-2006-4711

Multiple cross-site scripting XSS vulnerabilities in Sage allow remote attackers to inject arbitrary web script or HTML via an Atom 1.0 feed, as demonstrated by certain test cases of the James M. Snell Atom 1.0 feed reader test suite...

CVE-2006-4712

Multiple cross-site scripting XSS vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read...

Sage 1.3.x - IMG Element Input Validation

source: https://www.securityfocus.com/bid/21164/info The application is prone to an input-validation vulnerability that allows malicious HTML and script code to be injected before it is used in dynamically generated content. Attacker-supplied HTML and script code would execute in the context of t...

Sage 1.3.6 - Input Validation

source: https://www.securityfocus.com/bid/19928/info The application is prone to an input-validation vulnerability that allows malicious HTML and script code to be injected before it is used in dynamically generated content. Attacker-supplied HTML and script code would execute in the context of t...

Sage 1.3.x - IMG Element Input Validation

Sage 1.3.x - IMG Element Input Validation source: https://www.securityfocus.com/bid/21164/info The application is prone to an input-validation vulnerability that allows malicious HTML and script code to be injected before it is used in dynamically generated content. Attacker-supplied HTML and...

CVE-2003-1243

Sage 1.0 b3 is affected by a Cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary HTML or web script via the mod parameter. The issue is described without explicit exploit details or patched versions in the provided material; the CVSS indicates low-medium impa...

CVE-2003-1243

Cross-site scripting vulnerability XSS in Sage 1.0 b3 allows remote attackers to insert arbitrary HTML or web script via the mod parameter...

CVE-2003-1242

Sage 1.0 b3 is affected by a vulnerability where remote attackers can cause the server to disclose the root web server path by requesting a non-existent module, returning the path in an error message. The Red Hat CVE entry and related records corroborate the same description. The precise affected...

CVE-2003-1242

Sage 1.0 b3 allows remote attackers to obtain the root web server path via a URL request for a non-existent module, which returns the path in an error message...

Multiple vulnerabilities in Sage Saleslogix

Agenda Security Services Security Vulnerability Advisory Product: SalesLogix Server and Web Client Vendor: Sage Homepage: http://www.saleslogix.com Platforms: Microsoft Windows Impact: Bypass authentication Privilege escalation SQL injection Information leaks Arbitrary file creation Directory...