Cross site scripting

Cross-site scripting XSS vulnerability in SMBCMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the text parameter, which is used by the "Search Site" field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

[SECURITY] [DSA 943-1] New Perl packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 943-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

Ubuntu 4.10 : linux-source-2.6.8.1 vulnerabilities (USN-38-1)

CAN-2004-0814 : Vitaly V. Bursov discovered a Denial of Service vulnerability in the 'serio' code; opening the same tty device twice and doing some particular operations on it caused a kernel panic and/or a system lockup. Fixing this vulnerability required a change in the Application Binary...

Ubuntu 4.10 / 5.04 : php4, php4-universe vulnerability (USN-147-1)

A remote code execution vulnerability has been discovered in the XMLRPC module of the PEAR PHP Extension and Application Repository extension of PHP. By sending specially crafted XMLRPC requests to an affected web server, a remote attacker could exploit this to execute arbitrary code with the web...

Ubuntu 4.10 : lesstif1-1 vulnerabilities (USN-83-2)

USN-83-1 fixed some vulnerabilities in the 'lesstif2' library. The older 'lesstif1' library was also affected, however, a fix was not yet available at that time. This USN fixes the flaws for lesstif1. Please note that there are no supported applications that use this library, so this only affects...

Ubuntu 5.04 : libnet-ssleay-perl vulnerability (USN-113-1)

Javier Fernandez-Sanguino Pena discovered that this library used the file /tmp/entropy as a fallback entropy source if a proper source was not set in the environment variable EGDPATH. This can potentially lead to weakened cryptographic operations if an attacker provides a /tmp/entropy file with...

CVE-2005-4646

Unspecified vulnerability in index.php in PEARLINGER Pearl Forums 2.4 allows remote attackers to include arbitrary files via the mode parameter, possibly due to a directory traversal vulnerability. NOTE: the provenance of this information is unknown; the details are obtained solely from third par...

iDefense Security Advisory 01.09.06: Multiple Vendor mod_auth_pgsql Format String Vulnerability

Multiple Vendor modauthpgsql Format String Vulnerability iDefense Security Advisory 01.09.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=367 January 09, 2006 I. BACKGROUND The modauthpgsql apache module allows user authentication against information stored in a PostgreSQL...

AppServ appserv/main.php appserv_root Parameter Remote File Inclusion

The remote host appears to be running AppServ, a compilation of Apache, PHP, MySQL, and phpMyAdmin for Windows and Linux. The version of AppServ installed on the remote host fails to sanitize user-supplied input to the 'appservroot' parameter of the 'appserv/main.php' script before using it in a...

CVE-2005-4702

SQL injection vulnerability in the favorites module in index.php in IPBProArcade 2.5.2 allows remote attackers to inject arbitrary SQL commands via the gameid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. In addition,...

CVE-2005-4588

Cross-site scripting XSS vulnerability in Koobi 5 allows remote attackers to inject arbitrary web script or HTML via nested, malformed url BBCode tags. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2005-4450

Cross-site request forgery CSRF vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to serverprivileges.php, as demonstrated using the dbname and checkprivs parameters. NOTE: the provenance of this issue is unknown,...

CVE-2005-4434

Cross-site scripting XSS vulnerability in AbleDesign ReSearch 2.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2005-4276

Westell Versalink 327W allows remote attackers to cause a denial of service device crash via an IP packet with the same source and destination IPs and ports, and with the SYN flag set aka LanD. NOTE: the provenance of this issue is unknown; the details are obtained solely from third party...

Opera Web Browser 8.0/8.5 - HTML Form Status Bar Misrepresentation

source: https://www.securityfocus.com/bid/15472/info A vulnerability has been identified in Opera Web browser that allows an attacker to misrepresent the status bar in the browser, allowing vulnerable users to be mislead into following a link to a malicious site. This vulnerability would most...

CodeGrrl Applications Remote File Inclusion Vulnerabilities

The remote host appears to be running at least one of the PHP applications from CodeGrrl - PHPCalendar, PHPClique, PHPFanBase, or PHPQuotes. Under certain conditions, these applications fail to sanitize input to the 'siteurl' parameter of the 'protection.php' script before using it in a PHP...

TYPO3 Security Bulletin

Various security issues have been reported for PhpMyAdmin see www.securityfocus.com/bid/15196 for details. Component Type: Third Party Product, included with the TYPO3 core Affected Components: PhpMyAdmin Versions: TYPO3 3.8.0 and earlier Vulnerability Type: Various see below Severity: Medium...

chc_forum

A bug has been discovered in the "CHC Forum" chcforum extension where some Javascript expressions are not properly caught when entered in forms. Thus, specially crafted entries may be used to inject malicious code. Component Type: Third Party Extension. This extension is third party code that has...

th_mailformplus

A weakness in the form validation of thmailformplus has been discovered that may be abused to inject additional recipients in mail forms. Component Type: Third Party Extension. This extension is third party code that has not been submitted to the TYPO3 extension review process yet. The extension ...

BreakCalendar XSS Vulnerability

BreakCalendar is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...