Cross-origin data leakage from script filename in error messages — Mozilla

Security researcher Soroush Dalili reported that potentially sensitive URL parameters could be leaked across domains upon script errors when the script filename and line number is included in the error message...

NaviCOPA Web Server 2.0.1 - URL Handling Buffer Overflow (Metasploit)

$Id: navicopagetoverflow.rb 9797 2010-07-12 23:25:31Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

CVE-2010-1373

Cross-site scripting XSS vulnerability in Help Viewer in Apple Mac OS X 10.6 before 10.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted help: URL, related to "URL parameters in HTML content."...

Cross site scripting

Cross-site scripting XSS vulnerability in Help Viewer in Apple Mac OS X 10.6 before 10.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted help: URL, related to "URL parameters in HTML content."...

Unfixed XSS vulnerability at zapisy.pwr.wroc.pl

Security researcher maligree, has submitted on 16/05/2010 a cross-site-scripting XSS vulnerability affecting zapisy.pwr.wroc.pl, which at the time of submission ranked 31110 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/07/2010. It is...

CVE-2010-1342

Multiple PHP remote file inclusion vulnerabilities in Direct News 4.10.2, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 admin/menu.php and 2 library/lib.menu.php; and the adminroot parameter to 3...

SAGU-PRO v1.0 Multiple Remote File Include Vulnerability

Exploit for php platform in category web applications ======================================================== SAGU-PRO v1.0 Multiple Remote File Include Vulnerability ======================================================== \|/// \ - - // @ @...

CVE-2010-1114

Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pg parameter to index.php and the 2 path parameter to news/form.php...

Zenoss 2.3.3 SQL Injection

nGenuity Information Services -- Security Advisory Advisory ID: NGENUITY-2010-001 - Zenoss getJSONEventsInfo SQL Injection Application: Zenoss 2.3.3 Vendor: Zenoss Vendor website: http://www.zenoss.com Author: Adam Baldwin [email protected] Authentication: Valid user or admin session...

Update Protection against HP Power Manager Remote Code Execution

A remote code execution vulnerability exists within HP Power Manager, a web-based application for managing a HP Uninterruptible Power System UPS. The vulnerability is due to insufficient bounds checking in the HP Power Manager while processing URL parameters in the login form of the web based...

PeerCast 0.1216 Buffer Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'PeerCast %q...

Skype skype4com URI Handler Remote Heap Corruption (CVE-2007-5989)

Skype is a peer-to-peer Voice over IP VoIP Internet telephony network solution. The product is used to transfer real time conversations between two peers over the Internet. Skype users can speak to other Skype users, receive calls from traditional phones, and receive voice-mail messages. Peers ar...

openSUSE Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-383)

The Mozilla XULRunner 1.8.1 engine received backports for security problems in 1.9.0.5. The following security issues were fixed : MFSA 2008-68 / CVE-2008-5512 / CVE-2008-5511: Mozilla security researcher mozbugra4 reported that an XBL binding, when attached to an unloaded document, can be used t...

EUVD-2009-1547

Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 qtewebpath parameter to qteweb.php and the 2 qteroot parameter to bin/qteinit.php...

XMLHttpRequest 302 response disclosure — Mozilla

Marius Schilder of Google Security reported that when a XMLHttpRequest is made to a same-origin resource which 302 redirects to a resource in a different domain, the response from the cross-domain resource is readable by the site issuing the XHR. Cookies marked HttpOnly were not readable, but oth...

verisign-xss.txt

VeriSign Kontiki Delivery Management System DMS Cross-Site Scripting Vulnerability CVE Number: CVE-2008-4393 Vulnerability Type / Importance: XSS / Medium Problem discovered: September 24th 2007 Vendor contacted: September 26th 2007 Advisory published: March 28th 2008 Abstract The Kontiki Deliver...

CVE-2008-4337

CVE-2008-4337 is an XSS vulnerability in Bitweaver 2.0.2. The provided documents describe multiple vectors: arbitrary script/HTML injection via URL parameters across numerous pages (articles/edit/list; blogs/list_blogs/rankings; calendar and events pages; fisheye galleries; liberty/list_content; ...

Unfixed XSS vulnerability at www.almanac.com

Security researcher austinator, has submitted on 15/08/2008 a cross-site-scripting XSS vulnerability affecting www.almanac.com, which at the time of submission ranked 52857 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/08/2008. It is...

CVE-2008-3022

Multiple PHP remote file inclusion vulnerabilities in sablonlar/gunaysoft/gunaysoft.php in PHPortal 1.2 Beta allow remote attackers to execute arbitrary PHP code via a URL in 1 icerikyolu, 2 sayfaid, and 3 uzanti parameters...

Unfixed XSS vulnerability at www.kaobanga.com

Security researcher F3nix, has submitted on 07/01/2008 a cross-site-scripting XSS vulnerability affecting www.kaobanga.com, which at the time of submission ranked 397031 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/01/2008. It is currentl...