JVN#88325166 Hyper NIKKI System cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected hns-2.190.8 hns-lite-2.190.8 and earlier...

Multiple XSS Vulnerabilities in Zend Google Data Client Library Preview 0.2.0

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0008 Status: Partial Date: 2006/11/01 Summary: Armorize-ADV-2006-0008 discloses multiple cross-site scripting vulnerabilities that are found in the sample codes of Zend Google Data Client Library...

CommuniGate Pro Webmail 4.0.6 Session Hijacking Exploit

No description provided by source. !/usr/bin/perl Below is exploit code. Place it into cgi-bin, then recommended make symlink from DocumentRoot/AnyImage.gif to shj.pl, configure at least $url variable, and possible other vars and send victim HTML message with img src to your AnyImage.gif. When...

Re: Multiple XSS Vulnerabilities in Zen Cart 1.3.5

Full Disclosure Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0003 Status: Full Date: 2006/9/27 Summary: Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities that are found in Zen Cart, which is a PHP e-commerce shopping program and is Built on a...

Multiple XSS Vulnerabilities in Zen Cart 1.3.5

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0003 Date: 2006/9/27 Summary: Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities that are found in Zen Cart, which is a PHP e-commerce shopping program and is Built on a foundation of OScommerce GPL...

JVN#82240092 Drupal cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possible conduct session hijacking. Solution Products Affected Drupal 4.7.2 and earlier Drupal 4.6.8 and earlier...

JVN#79484135 Joomla! cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected Joomla! 1.0.8 and earlier...

JVN#30144870 SugarCRM cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected SugarCRM 4.2.1b and earlier SugarCRM 4.0.1g and earlier SugarCRM 3.5.1h and earlier...

JVN#68295640 Movable Type vulnerabile to cross-site scripting

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected Movable Type 3.3, 3.31, 3.32 Movable Type Enterprise 1.01, 1.02 For more information, refer to the...

JVN#46630603 MDPro cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected MDPro version 1.0.76 and earlier...

PT News 1.7.8 (Search.php) XSS Vulnerability

PT News 1.7.8 Search.php XSS Vulnerability ----------------------------------------------------------- PT News Version: 1.7.8 Website URL:http://www.openbg.net/ptsite/ ----------------------------------------------------------- Discoved by Snake Unkn0wn Security Researcher The original article ca...

[Full-disclosure] Session Token Remains Valid After Logout in IBM Lotus Domino Web Access

I. SYNOPSIS Title: Session Token Remains Valid After Logout in IBM Lotus Domino Web Access 7.0.1 Release Date: 09/12/2006 Affected Application: IBM Lotus Domino Web Access 7.0.1 versions prior to 7.0.1 were not tested but may still be vulnerable. Nominal Severity: Low Severity If Successfully...

Owl Intranet Engine <= 0.91 Multiple Vulnerabilities

The remote host is running Owl Intranet Engine, a web-based document management system written in PHP. The version of Owl Intranet Engine on the remote host fails to sanitize input to the session id cookie before using it in a database query. Provided PHP's 'magicquotesgpc' setting is disabled, a...

[Full-disclosure] Secunia Research: Jetbox Multiple Vulnerabilities

====================================================================== Secunia Research 02/08/2006 - Jetbox Multiple Vulnerabilities - ====================================================================== Table of Contents Affected Software....................................................1...

JVN#65677118 Pixelpost cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected Pixelpost 1.5 RC1-2 and earlier...

JVN#27794427 Dokeos cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In particular, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected Dokeos version 1.6.4 Patch 1 and earlier...

CVE-2006-3903

CRLF injection vulnerability in 1 index.php and 2 admin.php in myWebland MyBloggie 2.1.3 allows remote attackers to hijack sessions and conduct cross-site scripting XSS attacks via a cookie...

CVE-2006-3903

CVE-2006-3903 affects myWebland MyBloggie 2.1.3. The vulnerability is a CRLF injection in 1) index.php and 2) admin.php, allowing remote attackers to hijack sessions and perform cross-site scripting via a cookie. The NVD entry assigns a CVSS v2 base score of 5.8 (Medium) , with network access and...

Cross Site Scripting Vulnerability in Zoho Virtual Office

Hello, We have discovered a vunerability in Zoho Virtual Office. Malformed HTML message could lead to XSS Attack. It can cause a cookie theft leading to session hijacking. PoC: Simply creating HTML message including Javascript code could lead the browser's frame into evil script on attacker's...

zohoXSS.txt

Hello, We have discovered a vunerability in Zoho Virtual Office. Malformed HTML message could lead to XSS Attack. It can cause a cookie theft leading to session hijacking. PoC: Simply creating HTML message including Javascript code could lead the browser's frame into evil script on attacker's...