CVE-2005-4685

Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a...

VHCSXSS.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0006 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ VHCS 2.x HTTP Error Cross Site Scripting +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Nov 22, 2005 PUBLISHED AT...

pmwikiXSS.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0005 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ PmWiki 2.0.12 Cross Site Scripting +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Nov 22, 2005 PUBLISHED AT...

VHCS 2.x HTTP Error Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0006 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ VHCS 2.x HTTP Error Cross Site Scripting +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Nov 22, 2005 PUBLISHED AT...

CuteNews 'show_news.php' XSS Vulnerability

CuteNews is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2004 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cutephp:cutenews";...

WebWizXSS.txt

Bug : XSS in Web Wiz Forums cookie stealing Bug founded by : [email protected] Comment : I found this bug in +- 1 hour after some bitch asked me to help him, but he haven't do shit LOL Greets to : HaCkZaTaN, Johnnie Walker, Morinex, j0ker, Woopie, siLgi, bcuzZ. Big Fuck to : cobradrive, 0x1fe er...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

maxwebportalxss.txt

--Alt-Boundary-12164.15822371 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: Maxwebportal 1.3.5 and prior Risk: High MaxWebPortal is...

fuseXSS.txt

This was discovered by myself over the weekend. I cant find out what versions of fusebox this vulnerability is in but seeing as it affects the main fusebox page I can only assume it is the latest v4.1.0 and possibly some older versions. According to the Fusebox site, What is Fusebox? Fusebox is a...

Coldfusion Fusebox V4.1.0 Vulnerability

This was discovered by myself over the weekend. I cant find out what versions of fusebox this vulnerability is in but seeing as it affects the main fusebox page I can only assume it is the latest v4.1.0 and possibly some older versions. According to the Fusebox site, What is Fusebox? Fusebox is a...

cartWIZxss.txt

Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: XSS in CartWIZ Risk: Medium Cookie stealing store/viewCart.asp?message=%3Cplaintext%3E allows anyone to retrieve cookie and take control over the account. I noticed there are also some unchecked input when...

[HSC Security Group] XSS in CartWiz

Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: XSS in CartWIZ Risk: Medium Cookie stealing store/viewCart.asp?message=3Cplaintext3E allows anyone to retrieve cookie and take control over the account. I noticed there are also some unchecked input when a...

GLSA-200507-14 : Mozilla Firefox: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200507-14 Mozilla Firefox: Multiple vulnerabilities The following vulnerabilities were found and fixed in Mozilla Firefox: 'mozbugra4' and 'shutdown' discovered that Firefox was improperly cloning base objects MFSA 2005-56. Michae...

CVE-2005-2267

Firefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone...

Qualiteam X-Cart 4.0.8 - 'giftcert.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/13817/info X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. These vulnerabilities could permit remote attackers to pass malicious inpu...

Cross-site scripting by dropping javascript: link on tab — Mozilla

Dropping a javascript: or data: link on a tab executes in the context of the site already loaded in the tab. If an attacker could convince a user to drag and drop such a link on a particular tab this could be used to steal information or credentials associated with the site in that tab...

Input stealing from other tabs — Mozilla

Jakob Balle of Secunia reported two vulnerabilities in windows with multiple tabs. Malicious content in a background tab can attempt to steal information intended for the topmost tab by popping up prompt dialog that appears to come from the trusted site, or by silently redirecting input focus to ...

[Full-Disclosure] Xanga Login Cookie stealing Vunerability - GNAA Security Center

Vendor: Xanga URL: http://www.xanga.com/ Versions: Current Remote: Yes vendor notified: 06 Oct 2004 at 14:08 Vendor response: NONE Summary: Xanga is a fully featured blogging system, it provides great control over look & feel of a users blog by allowing HTML with only basic checks. Xanga has well...

Debian DSA-167-1 : kdelibs - XSS

A cross site scripting problem has been discovered in Konqueror, a famous browser for KDE and other programs using KHTML. The KDE team reportsthat Konqueror's cross site scripting protection fails to initialize the domains on sub-iframes correctly. As a result, JavaScript is able to access any...

CVE-2002-1152

CVE-2002-1152 concerns Konqueror (KDE) versions 3.0 through 3.0.2. The issue is that Konqueror does not reliably detect the secure flag on HTTP cookies, allowing cookies to be sent over unencrypted channels. This could enable remote attackers to capture cookies via sniffing, potentially compromis...