XSS through JavaScript same-origin violation — Mozilla

Mozilla contributor mozbugra4 submitted a set of vulnerabilities which allow scripts from one document to be executed in the context of a different document. These vulnerabilities could be used by an attacker to violate the same-origin policy and perform an XSS attack against arbitrary sites,...

CVE-2008-2878

CVE-2008-2878 is an open redirect vulnerability in rss_getfile.php of Academic Web Tools (AWT YEKTA), affecting versions 1.4.3.1 and 1.4.2.8 and earlier. The flaw allows remote attackers to redirect users to arbitrary websites and facilitate phishing via a URL supplied in the file parameter. The ...

emucms-sql.txt

AUTHOR : TurkishWarriorr HOME : http://www.1923turk.org Dork : Powered by emuCMS exploit : index.php?page=category&catid=-9999+union+all+select+1,concatuser,char58,passw ,char58,email,3,null,null,null,7,8,9,10,11,null +from+users-- Test Sites...

CVE-2008-1947.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2008-1947: Tomcat host-manager XSS vulnerability Severity: Low Vendor: The Apache Software Foundation Versions Affected: Tomcat 5.5.9 to 5.5.26 Tomcat 6.0.0 to 6.0.16 This issue has been fixed in the source repositories for each version and will b...

CVE-2008-1580

CFNetwork in Safari in Apple Mac OS X before 10.5.3 automatically sends an SSL client certificate in response to a web server's certificate request, which allows remote web sites to obtain sensitive information Subject data from personally identifiable certificates, and use arbitrary certificates...

CVE-2008-1580

CFNetwork in Safari in Apple Mac OS X before 10.5.3 automatically sends an SSL client certificate in response to a web server's certificate request, which allows remote web sites to obtain sensitive information Subject data from personally identifiable certificates, and use arbitrary certificates...

weblosninger-sqlxss.txt

Viva IsLaM sql / xss Multiple Vulnerabilities weblosning V1, V2,V3,V4 Script Name : Weblosning V1, V2,V3,V4 Demo http://www.simpelside.dk/ AuTh0r: Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM Email : [email protected] V1 ::V2 :: V3 :: V4 D0rk : allinurl: "index2.php?id" ==== SQL :::::::: 1 =====...

WebUD arbitrary program execution vulnerability

Overview WebUD, a web accessibility support tool, contains a vulnerability in its components that are automatically executed on it, which may allow execution of arbitrary code when a user accesses a malicious website. Impact A remote attacker could execute an arbitrary program, or read or overwri...

JVN#76788395 Sony mylo COM-2 does not verify server SSL certificate

Sony mylo COM-2, a mobile terminal equipped with a web browser and media palyer, contains a vulnerability where it does not verify the server certificate when connecting to a server via SSL/TLS. Impact Normally, when a client connects to a web server through a SSL/TLS connection, it would verify...

Alkacon OpenCms users_list.jsp searchfilter XSS

Alkacon OpenCms userslist.jsp searchfilter XSS Product: Alkacon OpenCms http://www.opencms.org/ OpenCms contains a cross-site scripting vulnerability in the user management function. Input to parameter searchfilter in page opencms/system/workplace/admin/accounts/userslist.jsp is not sufficiently...

Privacy issue with SSL Client Authentication — Mozilla

Peter Brodersen and Alexander Klink independently reported that the default setting for SSL Client Authentication, automatically selecting a client certificate on behalf of the user, creates a potential privacy issue for users by allowing tracking through client certificates. For users who alread...

alkaconopencms-xss.txt

Alkacon OpenCms userslist.jsp searchfilter XSS Product: Alkacon OpenCms http://www.opencms.org/ OpenCms contains a cross-site scripting vulnerability in the user management function. Input to parameter searchfilter in page opencms/system/workplace/admin/accounts/userslist.jsp is not sufficiently...

alkacon-xssdisclose.txt

Alkacon OpenCms logfileViewSettings.jsp XSS, file disclosure Product: Alkacon OpenCms http://www.opencms.org/ OpenCms contains a vulnerability in the Logfile Viewer Settings function. Input to Parameter filePath.0 in page opencms/system/workplace/admin/workplace/logfileview/logfileViewSettings.js...

Alkacon OpenCms logfileViewSettings.jsp XSS, file disclosure

Alkacon OpenCms logfileViewSettings.jsp XSS, file disclosure Product: Alkacon OpenCms http://www.opencms.org/ OpenCms contains a vulnerability in the Logfile Viewer Settings function. Input to Parameter filePath.0 in page opencms/system/workplace/admin/workplace/logfileview/logfileViewSettings.js...

Alkacon OpenCms tree_files.jsp resource XSS

Alkacon OpenCms treefiles.jsp resource XSS Product: Alkacon OpenCms http://www.opencms.org/ OpenCms contains a cross-site scripting vulnerability in the file tree navigation function. An invalid value supplied to parameter resource in page opencms/system/workplace/views/explorer/treefiles.jsp is...

mamboquran-sql.txt

+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --found by breakerunit and Don...

Mambo Component Quran 1.1 - surano SQL Injection

Mambo Component Quran 1.1 - surano SQL Injection +----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --found by breakerunit and Don...

Mambo Component Quran 1.1 - 'surano' SQL Injection

+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --found by breakerunit and Don...

Mozilla Foundation Security Advisory 2008-04

Mozilla Foundation Security Advisory 2008-04 Title: Stored password corruption Impact: Moderate Announced: February 7, 2008 Reporter: Justin Dolske Products: Firefox Fixed in: Firefox 2.0.0.12 Description Mozilla developer Justin Dolske discovered that malicious sites, upon a user saving his or h...

CVE-2008-0417

CRLF injection vulnerability in Mozilla Firefox before 2.0.0.12 allows remote user-assisted web sites to corrupt the user's password store via newlines that are not properly handled when the user saves a password...