[ISR] - Barracuda Spam Firewall. Cross-Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 || ISR || || Infobyte Security Research || www.infobyte.com.ar || 09.21.2007 || .:: SUMMARY Barracuda Spam Firewall Cross-Site Scripting Version: Barracuda Spam Firewall firmware v3.4.10.102 It is suspected that all previous versions of Barracuda Sp...

msforums-xss.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 XSS in http://forums.microsoft.com/ - could lead to cookie/account stealing, information disclosure and more... Start e.g. here: http://forums.microsoft.com/Genuine/default.aspx?SiteID=25 Enter one of the following examples in searchbox of forum, the...

eyeOS checksum prediction

Subject: eyeOS checksum prediction Author: Andrej Komarov [email protected] eyeOS operates with special intermediate checksums in plaintext. Without its validation it is impossible to make new actions to login, start new services. There is way to predict eyeOS checksum. If it is automated from...

USN-493-1: Firefox vulnerabilities

A flaw was discovered in handling of "about:blank" windows used by addons. A malicious web site could exploit this to modify the contents, or steal confidential data such as passwords, of other web pages. CVE-2007-3844 Jesper Johansson discovered that spaces and double-quotes were not correctly...

WebCT 4.1.5 - Email and Discussion Board Messages HTML Injection

WebCT 4.1.5 - Email and Discussion Board Messages HTML Injection source: https://www.securityfocus.com/bid/28107/info WebCT is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content...

WebCT 4.1.5 - Email and Discussion Board Messages HTML Injection

source: https://www.securityfocus.com/bid/28107/info WebCT is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML or JavaScript code could run in the context of the...

eNdonesia 8.4 - 'mod.php?viewarticle Action artid' SQL Injection

source: https://www.securityfocus.com/bid/24590/info eNdonesia is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the...

vbultop-xss.txt

+-------------------------------------------------------------------- + + New post Topic Hijacking XSS All vBulletin® v 3.x.x + +-------------------------------------------------------------------- + vendor site........: http://www.vbulletin.com/ + Affected Software .: vbulletin + Class...

[Full-disclosure] Apple Safari: cookie stealing

There is a vulnerability in Apple Safari, that allows an attacker to steal a cookie belonging to the arbitrary domain or/and fill the browser window with an arbitrary content, whereas the url bar and the browser's window title is derived from the selected domain. The flaw exists in the javascript...

[Full-disclosure] Assorted browser vulnerabilities

Hello, Will keep it brief. A couple of browser bugs, fresh from the oven, hand crafted with love: 1 Title : MSIE page update race condition CRITICAL Impact : cookie stealing / setting, page hijacking, memory corruption Demo : http://lcamtuf.coredump.cx/ierace/ ...aka the bait & switch...

Doop Content Management System 1.3.x - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/23482/info Doop Content Management System is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based authentication...

Advisory - Redirection Vulnerability in wp-login.php.

Vendor ------ Wordpress http://www.wordpress.org. Severity -------- Moderate. Dated ----- 03 March 2007. Versions Affected ----------------- All. Issue ----- The wp-login.php page redirects a user to arbitrary page after successful login by setting the redirectto url parameter. For example if a...

[Full-disclosure] Stealing Browser History Without Using JavaScript

In case anyone is interested, I was able to port the old CSS history hacking stuff that Jeremiah Grossman originally found to a version that does not require JavaScript to fire using images and conditional logic built into CSS using a:visited and display attributes. It works in both IE7.0 and...

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability

On Thu, 15 Feb 2007, pdp architect wrote: I wander whether we can execute code on about:config or about:cache. Actually, there are several odd problems related to location updates and location.hostname specifically, including one scenario that apparently makes the script run with document.locatio...

[Full-disclosure] Firefox focus stealing vulnerability (possibly other browsers)

There is an interesting logic flaw in Mozilla Firefox web browser. The vulnerability allows the attacker to silently redirect focus of selected key press events to an otherwise protected file upload form field. This is possible because of how onKeyDown / onKeyPress events are handled, allowing th...

[Full-disclosure] Firefox/MSIE focus stealing vulnerability - clarification

After some research, I can offer this clarification: 1 The MSIE 7 attack vector I described is a distinctive, new vulnerability that differs from the attack reported by Charles McAuley and Bart van Arnhem. Attacks described by them were fixed in MSIE7 although MSIE6 is still exposed to the origin...

flashChat 4.7.8 Cross Site Scripting Vulnerability

/ Flashchat 4.7.8 / Date of written Advisory: February 04, 2007 Product: Flash Chat = 4.7.8 Vendor: http://tufat.com/ Description: flashChat is a highly customizable PHP/MySQL based chat room script that is easily integrated into a website and mimics IRC in it's command structure Exploits /...

flashChat 4.7.8 Cross Site Scripting Vulnerability

/ Flashchat 4.7.8 / Date of written Advisory: February 04, 2007 Product: Flash Chat = 4.7.8 Vendor: http://tufat.com/ Description: flashChat is a highly customizable PHP/MySQL based chat room script that is easily integrated into a website and mimics IRC in it's command structure Exploits /...

shopsite-xss.txt

Hackers Center Security Group http://www.hackerscenter.com/ Doz's Security Advisory Desc: ShopSite Shopping Cart Multiple XSS Risk: Medium ShopSite™ is the easiest-to-use shopping cart software for small to medium-sized businesses. ShopSite ecommerce shopping cart is one of the most user-friendly...

JiRos Links Manager[injection sql & xss permanent]

vendor site:http://www.jiros.net/ product:JiRos Links Manager bug: injection sql & xss risk : medium injection sql: /openlink.asp?LinkID='sql /viewlinks.asp?CategoryID='sql xss permanent post: in: /submitlink.asp -Link Name: -Link URL: -Link Image: -Link Description: those xss are really dangerou...