S9Y Serendipity 1.3 - Referer HTTP Header Cross-Site Scripting

source: https://www.securityfocus.com/bid/28885/info S9Y Serendipity is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in t...

serendipity -- multiple cross site scripting vulnerabilities

Hanno Boeck reports: The installer of serendipity 1.3 has various Cross Site Scripting issues. This is considered low priority, as attack scenarios are very unlikely. Various path fields are not escaped properly, thus filling them with javascript code will lead to XSS. MySQL error messages are no...

[Full-disclosure] Cross site scripting issues in s9y (CVE-2008-1386, CVE-2008-1387)

Two smaller issues in s9y, published here: http://int21.de/cve/CVE-2008-1386-s9y.html http://int21.de/cve/CVE-2008-1387-s9y.html Cross Site Scripting XSS in serendipity 1.3 referrer plugin, CVE-2008-1385 References https://vulners.com/cve/CVE-2008-1385 http://www.s9y.org/ Description In the...

S9Y Serendipity 1.3 - Referer HTTP Header Cross-Site Scripting

S9Y Serendipity 1.3 - Referer HTTP Header Cross-Site Scripting source: https://www.securityfocus.com/bid/28885/info S9Y Serendipity is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker...

Debian: Security Advisory (DSA-1528-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1528-1 (serendipity)

The remote host is missing an update to serendipity announced via advisory DSA 1528-1. OpenVAS Vulnerability Test $Id: deb15281.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1528-1 serendipity Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian DSA-1528-1 : serendipity - insufficient input sanitising

Peter Huwe and Hanno Bock discovered that Serendipity, a weblog manager, did not properly sanitise input to several scripts which allowed cross site scripting. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

CVE-2008-1476

Cross-site scripting XSS vulnerability in Serendipity S9Y before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks...

CVE-2008-1476

Cross-site scripting XSS vulnerability in Serendipity S9Y before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks...

Cross site scripting

Cross-site scripting XSS vulnerability in Serendipity S9Y before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks...

CVE-2008-1476

Serendipity (S9Y) up to version 1.2.x is vulnerable to cross-site scripting via received trackbacks. Root cause: insufficient input sanitisation in several scripts. Impact: remote attackers can inject arbitrary script/HTML. Mitigation: upgrade to Serendipity 1.3 or later (per Debian DSAs and rela...

CVE-2008-1476

Cross-site scripting XSS vulnerability in Serendipity S9Y before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks...

[SECURITY] [DSA 1528-1] New serendipity packages fix cross site scripting

------------------------------------------------------------------------ Debian Security Advisory DSA-1528-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst March 24, 2008 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1528-1] New serendipity packages fix cross site scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1528-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst March 24, 2008 http://www.debian.org/security/faq -...

DSA-1528-1 serendipity - cross site scripting

Bulletin has no description...

CVE-2008-0124

Cross-site scripting XSS vulnerability in Serendipity S9Y before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via 1 the "Real name" field in Personal Settings, which is presented to readers of articles; or 2 a file upload, as demonstrated by a .htm, .html, or...

CVE-2008-1066

The modifier.regexreplace.php plugin in Smarty before 2.6.19, as used by Serendipity S9Y and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string...

Spoofing

The modifier.regexreplace.php plugin in Smarty before 2.6.19, as used by Serendipity S9Y and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string...

CVE-2008-0124

Cross-site scripting XSS vulnerability in Serendipity S9Y before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via 1 the "Real name" field in Personal Settings, which is presented to readers of articles; or 2 a file upload, as demonstrated by a .htm, .html, or...

Cross site scripting

Cross-site scripting XSS vulnerability in Serendipity S9Y before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via 1 the "Real name" field in Personal Settings, which is presented to readers of articles; or 2 a file upload, as demonstrated by a .htm, .html, or...