File stealing by changing input type — Mozilla

Claus Jörgensen reports that a text input box can be pre-filled with a filename and then turned into a file-upload control with the contents intact, allowing a malicious website the ability to steal any local file whose name they can guess...

PHPWebGallery 1.4.1 - picture.php Cross-Site Scripting

PHPWebGallery 1.4.1 - picture.php Cross-Site Scripting source: https://www.securityfocus.com/bid/17421/info PHPWebGallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...

PHP 4.x/5.0/5.1 - PHPInfo Large Input Cross-Site Scripting

source: https://www.securityfocus.com/bid/17362/info PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an...

CVE-2005-4684

Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for a...

CVE-2005-4684

Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for a...

CVE-2005-4685

Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a...

VHCSXSS.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0006 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ VHCS 2.x HTTP Error Cross Site Scripting +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Nov 22, 2005 PUBLISHED AT...

pmwikiXSS.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0005 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ PmWiki 2.0.12 Cross Site Scripting +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Nov 22, 2005 PUBLISHED AT...

VHCS 2.x HTTP Error Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0006 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ VHCS 2.x HTTP Error Cross Site Scripting +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Nov 22, 2005 PUBLISHED AT...

CuteNews 'show_news.php' XSS Vulnerability

CuteNews is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2004 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cutephp:cutenews";...

WebWizXSS.txt

Bug : XSS in Web Wiz Forums cookie stealing Bug founded by : [email protected] Comment : I found this bug in +- 1 hour after some bitch asked me to help him, but he haven't do shit LOL Greets to : HaCkZaTaN, Johnnie Walker, Morinex, j0ker, Woopie, siLgi, bcuzZ. Big Fuck to : cobradrive, 0x1fe er...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

maxwebportalxss.txt

--Alt-Boundary-12164.15822371 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: Maxwebportal 1.3.5 and prior Risk: High MaxWebPortal is...

fuseXSS.txt

This was discovered by myself over the weekend. I cant find out what versions of fusebox this vulnerability is in but seeing as it affects the main fusebox page I can only assume it is the latest v4.1.0 and possibly some older versions. According to the Fusebox site, What is Fusebox? Fusebox is a...

Coldfusion Fusebox V4.1.0 Vulnerability

This was discovered by myself over the weekend. I cant find out what versions of fusebox this vulnerability is in but seeing as it affects the main fusebox page I can only assume it is the latest v4.1.0 and possibly some older versions. According to the Fusebox site, What is Fusebox? Fusebox is a...

cartWIZxss.txt

Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: XSS in CartWIZ Risk: Medium Cookie stealing store/viewCart.asp?message=%3Cplaintext%3E allows anyone to retrieve cookie and take control over the account. I noticed there are also some unchecked input when...

[HSC Security Group] XSS in CartWiz

Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: XSS in CartWIZ Risk: Medium Cookie stealing store/viewCart.asp?message=3Cplaintext3E allows anyone to retrieve cookie and take control over the account. I noticed there are also some unchecked input when a...

GLSA-200507-14 : Mozilla Firefox: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200507-14 Mozilla Firefox: Multiple vulnerabilities The following vulnerabilities were found and fixed in Mozilla Firefox: 'mozbugra4' and 'shutdown' discovered that Firefox was improperly cloning base objects MFSA 2005-56. Michae...

CVE-2005-2267

Firefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone...

Qualiteam X-Cart 4.0.8 - 'giftcert.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/13817/info X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. These vulnerabilities could permit remote attackers to pass malicious inpu...