eZ Publish <= 2.2.7 Multiple XSS Vulnerabilities

eZ Publish is prone to multiple cross-site scripting XSS vulnerabiliites. SPDX-FileCopyrightText: 2003 k-otik.com Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Bugzilla < 2.18.1 Multiple Information Disclosures

According to its banner, the remote host is running a version of Bugzilla that reportedly may include passwords in the web server logs because it embeds a user's password in a report URL if the user is prompted to log in while viewing a chart. It also allows users to learn whether an invisible...

CVE-2005-0435

awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog...

CVE-2005-0281

Cross-site scripting XSS vulnerability in the web interface in Soldner Secret Wars 30830 allows remote attackers to inject arbitrary web script or HTML via a user message, which is not filtered or quoted when the administrator views the server logs...

[SECURITY] [DSA 674-1] New mailman packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 674-1 [email protected] http://www.debian.org/security/ Martin Schulze February 10th, 2005 http://www.debian.org/security/faq -...

CVE-2005-0281

The CVE-2005-0281 entry describes an XSS in the web interface of Soldner Secret Wars 30830. The vulnerability arises because a user message is not filtered or quoted when administrators view server logs, allowing remote attackers to inject arbitrary web script or HTML. Documented references catal...

CVE-2005-0281

Cross-site scripting XSS vulnerability in the web interface in Soldner Secret Wars 30830 allows remote attackers to inject arbitrary web script or HTML via a user message, which is not filtered or quoted when the administrator views the server logs...

CVE-2004-0706

Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files...

CVE-2001-1403

Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading the information from the web server logs, or by "shoulder-surfing" and observing the web browser's location bar...

CORRECTION to CODE: FormMail.pl can be used to send anonymous email

Hi All, I did a little playing with FormMail.pl after a run in with a spammer abusing our webserver. Apparently ALL FormMail.pl cgi-bin scripts can be used to spam anonymously. I found another server with FormMail.pl and tried the same exploit to send myself an email and it worked. The email will...