Photostore - 'details.php?gid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20172/info Photostore is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecti...

BandSite CMS 1.1 - 'news_content.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20137/info Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data. These issues may allow an attacker to access sensitive information, execute arbitrary server-side...

Snitz Forums 2000 - 'forum.asp' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20004/info Snitz Forums 2000 is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. This could allow an attacker to steal cookie-based authentication credentials and launch other attacks. Version...

Sun ONE and Sun Java System Applications vulnerable to cross-site scripting via default error page

Overview A cross-site scripting vulnerability in Sun ONE and Sun Java System Applications may allow an attacker to read or modify data in web pages and cookies. Description From Sun Alert Notification 102164: A Cross Site Scripting XSS vulnerability in various releases of the Sun Java System Web...

VWar 1.x - war.php?page Cross-Site Scripting

VWar 1.x - war.php?page Cross-Site Scripting source: https://www.securityfocus.com/bid/19327/info Vwar is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. These issues occur because the application fails to properly sanitize user-supplie...

CVE-2006-3837

delcookie.php in Professional Home Page Tools Guestbook changes the expiration date of a cookie instead of deleting the cookie's value, which makes it easier for attackers to steal the cookie and obtain the administrator's password hash after logout...

PHP Pro Bid 5.2.4 - categories.php?orderType SQL Injection

PHP Pro Bid 5.2.4 - categories.php?orderType SQL Injection source: https://www.securityfocus.com/bid/19158/info PHP Pro Bid is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize...

JVN#73705637 ACollab SQL injection vulnerability

Impact A remote attacker could modify the database contents or steal data. An attacker could also bypass authentication and impersonate a user. Solution Products Affected ACollab 1.2 and earlier Development and maintenance of ACollab finished with version 1.2 as of July 6, 2006. However ATutor...

CVE-2006-3328

newticket.cgi in Hostflow 2.2.1-15 allows remote attackers to steal and replay authentication credentials via an IMG tag in the desc parameter "Ticket Description" field that points to a URL that captures referer URLs, possibly due to a cross-site scripting XSS vulnerability or a leak of...

[Kil13r-SA-20060628] Hanaro Search Cross-Site Scripting Vulnerability

Title: Kil13r-SA-20060628 Hanaro Search Cross-Site Scripting Vulnerability Author: Kil13r - http://www.kil13r.info/ Local / Remote: Remote Timeline: 2006/06/22 - Discovery 2006/06/28 - Release Affected version: Not affected version: Description: Hanaro is ISP site, but that has vulnerability. It...

V3 Chat Instant Messenger - mailindex.php?id Cross-Site Scripting

V3 Chat Instant Messenger - mailindex.php?id Cross-Site Scripting source: https://www.securityfocus.com/bid/18543/info V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize...

Gphotos 1.41.5 - index.php?rep Traversal Arbitrary Directory Listing

Gphotos 1.41.5 - index.php?rep Traversal Arbitrary Directory Listing source: https://www.securityfocus.com/bid/17967/info Gphotos is prone to multiple input-validation vulnerabilities. The issues include information-disclosure and cross-site scripting vulnerabilities. These issues are due to a...

CyberBuild - 'browse0.htm?ProductIndex' SQL Injection

source: https://www.securityfocus.com/bid/17829/info CyberBuild is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. A...

TextFileBB 1.0.16 Multiple XSS

TextFileBB is a flat-file based bulletin board system written in PHP. There are 3 different XSS vulnerabilities in this software at the moment, which I found about half an hour ago =D Anyway, the XSS lies in these tags: color size url EXPLANATION: Firstly, we'll explain color. code.color=00'"0FFF...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2006:078)

A number of vulnerabilities have been discovered in the Mozilla Thunderbird email client that could allow a remote attacker to craft malicious web emails that could take advantage of these issues to execute arbitrary code with elevated privileges, spoof content, and steal local files, or other...

Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2006:075)

A number of vulnerabilities have been discovered in the Mozilla Firefox browser that could allow a remote attacker to craft malicious web pages that could take advantage of these issues to execute arbitrary code with elevated privileges, spoof content, and steal local files, cookies, or other...

Mozilla Firefox: Multiple vulnerabilities

Background Mozilla Firefox is the next-generation web browser from the Mozilla project. Description Several vulnerabilities were found in Mozilla Firefox. Versions 1.0.8 and 1.5.0.2 were released to fix them. Impact A remote attacker could craft malicious web pages that would leverage these issue...

cross-site scripting through window.controllers — Mozilla

shutdown demonstrated how to use the window.controllers array to bypass same-origin protections, allowing a malicious site to inject script into content from another site. This could allow the malicious page to steal information such as cookies or passwords from the other site, or perform...

MusicBox 2.3 - index.php SQL Injection

MusicBox 2.3 - index.php SQL Injection source: https://www.securityfocus.com/bid/17149/info MusicBox is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly...

NZ eCommerce System - index.php Multiple SQL Injections

NZ eCommerce System - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/16931/info NZ Ecommerce is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. A successful exploit could...