Frox 0.7.18 - Arbitrary Configuration File Access

source: https://www.securityfocus.com/bid/14711/info Frox is prone to a vulnerability that permits read access to arbitrary files. Successful exploitation of this vulnerability will grant the attacker read access to arbitrary files on the system in the security context of the Frox process...

phpLDAPadmin 0.9.60.9.7 - welcome.php Arbitrary File Inclusion

phpLDAPadmin 0.9.60.9.7 - welcome.php Arbitrary File Inclusion source: https://www.securityfocus.com/bid/14695/info phpldapadmin is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. phpldapadmin is...

Important: Red Hat Security Advisory: php security update

Updated PHP packages that fix a security issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A bug was discovered in the PEAR XML-RP...

OS2A-1001.txt

OS2A ePing Arbitrary File Creation/Command Execution Vulnerability OS2A ID: OS2A1001 Status Published: 08/04/2005 Updated : 08/05/2005 Patch Released Class: File Creation/Command Execution Severity: CRITICAL Overview: ePing is a ping utility plugin for e107, a PHP-based content management system...

CVE-2001-1514

CVE-2001-1514 affects ColdFusion 4.5 and 5 on Windows when the advanced security sandbox type is set to operating system. The issue is that security context is not properly passed to child processes created with or to those that call CreateProcess and are run via or end with the CFX extension, ...

Apple Web Kit-based browsers may allow remote access to local filesystem contents

Overview Web browsers based on AppleWebKit may allow remote web sites to reference content on the local filesystem. This may allow an attacker to execute script within the security context of the local machine. Description Web browsers that allow remote web sites to reference content that resides...

CVE-2005-1792

The connected Seebug document confirms CVE-2005-1792 affects Microsoft Windows XP via the WMI service. The vulnerability allows remote attackers to trigger a denial-of-service by causing memory leaks and system unresponsiveness because security contexts are created faster than RPC cache entries c...

CVE-2005-0150

Firefox before 1.0 allows the user to store a 1 javascript: or 2 data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code...

CVE-2005-0150

Firefox before 1.0 allows the user to store a 1 javascript: or 2 data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code...

Skull-Splitter Guestbook 1.02.02.2 - Multiple HTML Injection Vulnerabilities

Skull-Splitter Guestbook 1.02.02.2 - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/13632/info Skull-Splitter Guestbook is prone to multiple HTML injection vulnerabilities. It is possible to inject HTML and script code into the title and content of posted...

Skull-Splitter Guestbook 1.0/2.0/2.2 - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/13632/info Skull-Splitter Guestbook is prone to multiple HTML injection vulnerabilities. It is possible to inject HTML and script code into the title and content of posted messages. The attacker-supplied HTML and script code would be able to access...

PHP-Nuke 6.x7.x Downloads Module - Lid Cross-Site Scripting

PHP-Nuke 6.x7.x Downloads Module - Lid Cross-Site Scripting source: https://www.securityfocus.com/bid/13011/info It is reported that the PHP-Nuke 'Downloads' module is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize...

paNews20b4.txt

PersianHacker.NET 200505-06 paNews v2.0b4 XSS Vulnerability Date: 2005 February Bug Number: 06 paNews is a news management script to use on your site. Users can use paCode, special code designed to allow the adding of images and font changes in the posts without allowing users to use HTML to post...

CVE-2005-0150

CVE-2005-0150 affects Mozilla Firefox versions prior to 1.0. The bug allows storing javascript: or data: Livefeed bookmarks that are later executed in the context of the current page, enabling remote attackers to potentially run arbitrary code. Public descriptions consistently state Firefox pre-1...

MySQL Eventum index.php email Parameter XSS

The MySQL Eventum install hosted on the remote web server is vulnerable to a cross-site scripting attack because it fails to sanitize user-supplied input to the 'email' parameter of the 'index.php' script before using it to generate dynamic HTML output. With a specially crafted URL, an attacker c...

IBM Lotus Domino 6.x - Cross-Site Scripting HTML Injection

IBM Lotus Domino 6.x - Cross-Site Scripting HTML Injection source: https://www.securityfocus.com/bid/11458/info It is reported that Lotus Domino is susceptible to a cross-site scripting and an HTML injection vulnerability. These issues are due to a failure of the application to properly sanitize...

Citrix NFuse Launch Scripts 'NFuse_Application' Parameter XSS

The remote version of Citrix NFuse contains a flaw that allows a remote cross-site scripting attack. An attacker can exploit this issue to execute arbitrary HTML or script code in a user's browser within the security context of the affected site. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Cross Site Scripting Vulnerability in Sympa

--------------------------------------------------------------------------- Cross Site Scripting Vulnerability in Sympa --------------------------------------------------------------------------- Author: Joxean Koret Date: 2004 Location: Basque Country...

VulnCheck KEV: CVE-2004-0549

The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine MSHTML, as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as...

APSIS Pound 1.5 - Remote Format String

// source: https://www.securityfocus.com/bid/10267/info APSIS Pound has been found to be prone to a remote format string vulnerability. The problem presents itself when Pound handles certain requests containing embedded format string specifiers. Ultimately this vulnerability could allow for...