[DSECRG-09-013] IBM WebSphere Application Server 7.0 Multiple XSS Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-013 !!! official advisory: !!! http://dsecrg.com/pages/vul/DSECRG-09-013.html Application: IBM WebSphere Application Server Versions Affected: 7.0 and 6.1 Vendor URL: http://www.ibm.com/websphere/ Bug: Multiple XSS Vulnerabilities Exploits...

Cross site scripting

Cross-site scripting XSS vulnerability in ActionScript in arbitrary Shockwave Flash SWF controller files created by Techsmith Camtasia Studio before 5 allows remote attackers to inject arbitrary additional SWF content via a URL in the csPreloader parameter...

Protection bypass and crossite scripting in Sonicwall SOHO

It's possible to access banned site and to insert javascript into log file by using URL javascript injection...

MS Internet Explorer URL Injection in History List (MS04-004)

No description provided by source. // Andreas Sandblad, 2004-02-03, patched by MS04-004 // Name: payload // Purpose: Run payload code called from Local Machine zone. // The code may be arbitrary such as executing shell commands...

DSECRG-08-016.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-016 Application: Jinzora Media Jukebox Versions Affected: 2.7.5 Vendor URL: http://www.jinzora.com/ Bugs: Multiple XSS Injections Exploits: YES Reported: 04.02.2008 Second report: 12.02.2008 Vendor response: NONE Date of Public Advisory:...

CVE-2002-2418

Cross-site scripting XSS vulnerability in acFreeProxy aka acFP 1.33 beta 7 allows remote attackers to inject arbitrary web script or HTML via the URL, which is inserted into an error page...

Design/Logic Flaw

Argument injection vulnerability in Apple QuickTime 7.2 for Windows XP SP2 and Vista allows remote attackers to execute arbitrary commands via a URL in the qtnext field in a crafted QTL file. NOTE: this issue may be related to CVE-2006-4965 or CVE-2007-5045...

CVE-2007-5010

Cross-site scripting XSS vulnerability in WebBatch allows remote attackers to inject arbitrary web script or HTML via the URL to webbatch.exe...

CVE-2007-1280

Cross-site scripting XSS vulnerability in Adobe RoboHelp X5, 6, and Server 6 allows remote attackers to inject arbitrary web script or HTML via a URL after a hash in the URL path, as demonstrated using en/frameset-7.html, and possibly other unspecified vectors involving templates and 1 whstart.js...

advisory-php-gaestebuch-en.txt

-------------------------------------------------------- PHP-Gaestebuch v1.63 Script Injection Vulnerability | Discovered by Trew | ICEnetX Team http://icenetx.net | http://trew.icenetx.net [email protected] | -------------------------------------------------------- Date: 04 marzo 2007...

XSS in eWay

hey guys .. check out this new xss i just found ;P Vulnerable : eWay web : http://www.eway.no/eway XSS : http://127.0.0.1/path/default.aspx?pid="scriptalert'bl4ck'/script Discovered By BLacK ZeRo [email protected] Best regards ,,...

CVE-2007-0526

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the URL PATHINFO to 1 articles/edit.php, 2 articles/list.php, 3 blogs/listblogs.php, or 4 blogs/rankings.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the URL PATHINFO to 1 articles/edit.php, 2 articles/list.php, 3 blogs/listblogs.php, or 4 blogs/rankings.php...

PHPMyphorum 1.5a (mep/frame.php) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ================================================================== PHPMyphorum 1.5a mep/frame.php Remote File Include Vulnerability ================================================================== PHPMyphorum 1.5a Class: File Include...

CVE-2006-5460

CVE-2006-5460 describes multiple PHP remote file inclusion vulnerabilities in Hinton Design phpht Topsites that allow remote code execution via a URL parameter (phpht_real_path) to index.php, other top-level scripts, and admin scripts. The description notes CVE-2006-5460 is disputed because phpht...

CVE-2006-5137

Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to 1 inject PHP code via a theme array parameter to admin/doedittheme.php, which is injected into includes/theme.inc.php; 2 inject PHP code via a config array parameter to...

CVE-2006-3841

WebScarab is affected by an XSS flaw in its URL handling: before 20060718-1904, when used with IE 6 SP2 or Konqueror 3.5.3, it returns the requested URL in an error message without sanitizing script/HTML. This can allow remote attackers to inject arbitrary web script or HTML. The connected docume...

about.txt

About.com Homepage: http://www.about.com Effected files: Search input box fullsearch.htm shortform.htm forum.aspx profilecenter.asp posting in the forum ----------------------------------- Search input box xss vuln with cookie disclosure: Works by putting the tags in the input box, or doing url...

CVE-2006-3044

CVE-2006-3044 is a documented XSS in LogiSphere 1.6.0. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the URL, with the malicious code reflected in an error page. The NVD entry provides a CVSSv2 base score of 2.6 (LOW) with vector AV:N/AC:H/Au:N/C:N/I:P/A:N. ...

f_dp-6.1.x.txt

----------------------------------------------------- Advisory id: FSA:013 Author: Federico Fazzi Date: 12/06/2006, 9:31 Sinthesis: DCP-Portal 6.1.x, Remote command execution Type: high Product: http://www.dcp-portal.org/ Patch: unavailable ----------------------------------------------------- 1...