Ruby on Rails多个跨站脚本执行漏洞

BUGTRAQ ID: 52264 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 通过SafeBuffer直接操作传递的输入没有正确过滤，通过手动生成的选择标签传递的某些输入没有正确过滤，导致在用户浏览器中执行任意HTML和脚本代码 0 Ruby on Rails 3.2.x Ruby on Rails 3.1.x Ruby on Rails 3.0.x 厂商补丁： Ruby ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.ruby-lang.org/...

Etano 1.201.22 - photo_search.php Multiple Cross-Site Scripting Vulnerabilities

Etano 1.201.22 - photosearch.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/52295/info Etano is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues t...

Etano 1.20/1.22 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/52295/info Etano is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

LDAP Account Manager Pro 3.6 跨站脚本和HTML注入漏洞

LDAP Account Manager LAM是一个基于浏览器的LDAP帐号管理系统 LDAP Account Manager LAM存在多个持久型输入校验漏洞，允许攻击者在应用程序段实现恶意脚本代码，成功利用漏洞操作数据或劫持会话user/mod/admin 另外也受客户端跨站脚本漏洞，允许攻击者劫持目标用户/admin会话 0 LDAP Account Manager Pro 3.6 厂商解决方案 目前没有详细解决方案提供： http://lam.sourceforge.net/index.htm...

starCMS - q URI Cross-Site Scripting

starCMS - q URI Cross-Site Scripting source: https://www.securityfocus.com/bid/52262/info starCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Dotclear 2.4.1.2 - admincomments.php Multiple Cross-Site Scripting Vulnerabilities

Dotclear 2.4.1.2 - admincomments.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issu...

Dotclear 2.4.1.2 - adminplugin.php?page Cross-Site Scripting

Dotclear 2.4.1.2 - adminplugin.php?page Cross-Site Scripting source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrar...

Dotclear 2.4.1.2 - '/admin/plugin.php?page' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Dotclear 2.4.1.2 - '/admin/blogs.php?nb' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Anchor v0.6-0.4 CMS - Persistent Web Vulnerability

Document Title: =============== Anchor v0.6-0.4 CMS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=453 Release Date: ============= 2012-02-28 Vulnerability Laboratory ID VL-ID: ==================================== 453...

Fork CMS 3.x - '/backend/modules/error/actions/index.php?parse()' Multiple Error Display Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/52236/info Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary script cod...

Fork CMS 3.x - '/private/en/locale/index?name' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52236/info Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary script cod...

Bontq - 'user/' URI Cross-Site Scripting

source: https://www.securityfocus.com/bid/52183/info Bontq is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

D-Link DCS - security.cgi Cross-Site Request Forgery

D-Link DCS - security.cgi Cross-Site Request Forgery source: https://www.securityfocus.com/bid/52134/info The D-Link DCS-900, DCS-2000, and DCS-5300 are prone to a cross-site request-forgery vulnerability. Successful exploits may allow attackers to run privileged commands on the affected device,...

D-Link DCS - 'security.cgi' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/52134/info The D-Link DCS-900, DCS-2000, and DCS-5300 are prone to a cross-site request-forgery vulnerability. Successful exploits may allow attackers to run privileged commands on the affected device, change configuration, cause denial-of-service...

ContentLion Alpha 1.3 - login.php Cross-Site Scripting

ContentLion Alpha 1.3 - login.php Cross-Site Scripting source: https://www.securityfocus.com/bid/52112/info ContentLion Alpha is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script...

Oxwall 1.1.1 - plugin Cross-Site Scripting

Oxwall 1.1.1 - plugin Cross-Site Scripting source: https://www.securityfocus.com/bid/52125/info Oxwall is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of...

Adobe Flash Player Multiple Vulnerabilities (Windows) - Feb12

This host is installed with Adobe Flash Player and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodadobeflashplayermultvulnwinfeb12.nasl 8178 2017-12-19 13:42:38Z cfischer $ Adobe Flash Player Multiple Vulnerabilities Windows - Feb12 Authors: Rachana Shetty Copyright:...

ContentLion Alpha 1.3 - 'login.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52112/info ContentLion Alpha is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

Oxwall 1.1.1 - 'plugin' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52125/info Oxwall is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...