CVE-2009-3856

Cross-site scripting XSS vulnerability in the default URI in news/ in Twilight CMS before 4.1 allows remote attackers to inject arbitrary web script or HTML via the calendar parameter. NOTE: some of these details are obtained from third party information...

Multiple Browsers Telnet URI Handler File Manipulation (CVE-2004-0411; CVE-2004-0473)

There exists a vulnerability that affects various web-browsers. Insufficient input validation for telnet URI e.g., telnet://hostname can cause the Telnet software activated by the browsers to treat specially crafted Telnet URI as command-line options. As such, a malicious attacker may be able to...

e-Courier CMS Tracking xss

Exploit for unknown platform in category web applications ========================== e-Courier CMS Tracking xss ========================== Vendor: e-Courier http://www.ecouriersoftware.com/ Product: CMS Tracking Site Issue: Cross-Site Scripting. Description: Nearly all pages include the URI...

FreeBSD : KDE -- multiple vulnerabilities (6f358f5a-c7ea-11de-a9f3-0030843d3802)

oCERT reports : Ark input sanitization errors: The KDE archiving tool, Ark, performs insufficient validation which leads to specially crafted archive files, using unknown MIME types, to be rendered using a KHTML instance, this can trigger uncontrolled XMLHTTPRequests to remote sites. IO Slaves...

Stratek Web Design Twilight CMS 4.0 - 'calendar' Cross-Site Scripting

source: https://www.securityfocus.com/bid/41895/info Twilight CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context ...

KDE -- multiple vulnerabilities

oCERT reports: Ark input sanitization errors: The KDE archiving tool, Ark, performs insufficient validation which leads to specially crafted archive files, using unknown MIME types, to be rendered using a KHTML instance, this can trigger uncontrolled XMLHTTPRequests to remote sites. IO Slaves inp...

Wowd search client multiple variable xss

No description provided by source. Wowd search client multiple variable xss Vendor URL: http://www.wowd.com/ Advisore:http://lostmon.blogspot.com/2009/10/ wowd-search-client-multiple-variable.html Vendor notify:yes exploit available:yes What is Wowd? Wowd is a real-time search engine for...

Dogfood CRM spell.php Remote Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Dogfood CRM...

TikiWiki tiki-graph_formula Remote Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'TikiWiki...

AWStats migrate Remote Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'AWStats...

HTTP GET Request URI Fuzzer (Fuzzer Strings)

This module sends a series of HTTP GET request with malicious URIs. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP GET Request URI Fuzzer Fuzzer Strings', 'Description' = %q This module...

KDE multiple security vulnerabilities

Crossaplication scripting in Ark, protocol URI handlers, KMail...

Wowd Search Client 1.3.0 XSS

Exploit for unknown platform in category web applications ============================ Wowd Search Client 1.3.0 XSS ============================ Wowd search client multiple variable xss Vendor URL: http://www.wowd.com/ Vendor notify:yes exploit available:yes What is Wowd? Wowd is a real-time sear...

Wowd Search Client XSS

Wowd search client multiple variable xss Vendor URL: http://www.wowd.com/ Advisore:http://lostmon.blogspot.com/2009/10/ wowd-search-client-multiple-variable.html Vendor notify:yes exploit available:yes What is Wowd? Wowd is a real-time search engine for discovering what's popular on the web right...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the lastmessage parameter to 1 add.php, 2 toBePublished.php, 3 index.php, and 4 admin.php; the PATHINFO to the default URI to 5 category.php, 6 department.php, 7...

CVE-2009-3789

Multiple cross-site scripting XSS vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the lastmessage parameter to 1 add.php, 2 toBePublished.php, 3 index.php, and 4 admin.php; the PATHINFO to the default URI to 5 category.php, 6 department.php, 7...

CVE-2009-3617

Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service application crash via format string specifiers in a download URI. NOTE: som...

Format string

Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service application crash via format string specifiers in a download URI. NOTE: som...

CVE-2009-3617

Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service application crash via format string specifiers in a download URI. NOTE: som...

IBM Installation Manager iim URI Handling Code Execution

Added: 10/16/2009 CVE: CVE-2009-3518 BID: 36549 OSVDB: 58420 Background IBM Installation Manager IIM is a software tool that helps to install, update, modify, and uninstall packages. Problem When IIM is installed it registers the application IBMIM.exe as the iim:// scheme handler, so when an iim:...