Invision Power Board (IP.Board) 3.0 - Multiple HTML Injection Information Disclosure Vulnerabilities

Invision Power Board IP.Board 3.0 - Multiple HTML Injection Information Disclosure Vulnerabilities source: https://www.securityfocus.com/bid/34725/info Invision Power Board is prone to an information-disclosure issue and multiple HTML-injection vulnerabilities because it fails to properly sanitiz...

Sql injection

Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the play action in a mega:// URI...

CVE-2008-6748

Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the play action in a mega:// URI...

Google Chrome < 1.0.154.59 ChromeHTML URI Handling Privilege Escalation

The version of Google Chrome installed on the remote host is earlier than 1.0.154.59. Such versions are reportedly affected by an issue when handling URLs with a 'chromehtml:' protocol that could allow an attacker to run scripts of his choosing on any page or enumerate files on the local disk. If...

Mandriva Linux Security Advisory : apache (MDVSA-2008:195)

A vulnerability was discovered in the modproxy module in Apache where it did not limit the number of forwarded interim responses, allowing remote HTTP servers to cause a denial of service memory consumption via a large number of interim responses CVE-2008-2364. A cross-site scripting vulnerabilit...

Mozilla Foundation Security Advisory 2009-22

Mozilla Foundation Security Advisory 2009-22 Title: Firefox allows Refresh header to redirect to javascript: URIs Impact: Moderate Announced: April 21, 2009 Reporter: Michael Products: Firefox, SeaMonkey Fixed in: Firefox 3.0.9 Description Mozilla community member Michael reported that when a...

FreeBSD : URI handler vulnerabilities in several browsers (df333ede-a8ce-11d8-9c6d-0020ed76ef5a)

Karol Wiesek and Greg MacManus reported via iDEFENSE that the Opera web browser contains a flaw in the handling of certain URIs. When presented with these URIs, Opera would invoke external commands to process them after some validation. However, if the hostname component of a URI begins with a -'...

Mandriva Linux Security Advisory : lynx (MDVSA-2008:218)

A vulnerability was found in the Lynxcgi: URI handler that could allow an attacker to create a web page redirecting to a malicious URL that would execute arbitrary code as the user running Lynx, if they were using the non-default Advanced user mode CVE-2008-4690. This update corrects these issues...

MDVA-2008:159 : curl

An idiosyncratic feature of the Turkish language is that the letter 'i' in Turkish is not the lower-case version of the letter 'I'. This issue breaks standard POSIX string case comparison on strings containing the character 'i'. This issue affected the curl package shipped with Mandriva Linux 200...

Mozilla Foundation Security Advisory 2009-20

Mozilla Foundation Security Advisory 2009-20 Title: Malicious search plugins can inject code into arbitrary sites Impact: Low Announced: April 21, 2009 Reporter: Prateek Saxena Products: Firefox Fixed in: Firefox 3.0.9 Description Security researcher Prateek Saxena reported that a malicious...

FreeBSD : gnomevfs -- unsafe URI handling (7884d56f-f7a1-11d8-9837-000c41e2cdad)

Alexander Larsson reports that some versions of gnome-vfs and MidnightCommander contain a number of extfs' scripts that do not properly validate user input. If an attacker can cause her victim to process a specially crafted URI, arbitrary commands can be executed with the privileges of the victim...

FreeBSD : libxml2 stack buffer overflow in URI parsing (847ade05-6717-11d8-b321-000a95bc6fae)

Yuuichi Teranishi reported a crash in libxml2's URI handling when a long URL is supplied. The implementation in nanohttp.c and nanoftp.c uses a 4K stack buffer, and longer URLs will overwrite the stack. This could result in denial-of-service or arbitrary code execution in applications using libxm...

Mandrake Linux Security Advisory : xine-ui (MDKSA-2007:154)

Format string vulnerability in the errorscreatewindow function in errors.c in xine-ui allows attackers to execute arbitrary code via unknown vectors. CVE-2007-0254 XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service application crash and possibly execute arbitrary code...

Fedora 10 2008-10000

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

FreeBSD : jetty -- multiple vulnerability (0832ee18-cf77-11dc-8c6a-00304881ac9a)

Greg Wilkins reports : jetty allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' characters in the URI. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuX...

Cross site scripting

Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header or 2 specifying the content of a Refresh header. NOTE...

CVE-2009-1307

The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to 1 bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; 2 read, create, or modify...

Design/Logic Flaw

The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to 1 bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; 2 read, create, or modify...

CVE-2009-1307

The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to 1 bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; 2 read, create, or modify...

CVE-2009-1307

CVE-2009-1307 is evidenced in connected documents as a vulnerability in the view-source: URI handling in Mozilla Firefox before 3.0.9 (also affecting Thunderbird and SeaMonkey) that breaks the Same Origin Policy. It enables remote attackers to bypass cross-domain restrictions and connect to arbit...