SecurityFocus.com Cross Site Scripting

Original Advisory http://www.dsecrg.com/pages/vul/show.php?id=63 Digital Security Research Group DSecRG Advisory DSECRG-09-007 Application: SecurityFocus.com Vendor URL: http://www.securityfocus.com Bugs: XSS Exploits: YES Reported: 21.01.2009 Vendor response: none Second report: 23.01.2009 Vendo...

PT-2008-4800 · Runesoft · Cerberus Cms

Name of the Vulnerable Software and Affected Versions: Runesoft Cerberus CMS versions prior to 3 1.4 0.9 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a cerberus user cookie. This enables attackers to execute malicious scripts on...

HastyMail HTML Attachment Content-Disposition Header XSS

Binary data 2167.prm...

BasiliX Webmail 1.1 - Email Header HTML Injection

source: https://www.securityfocus.com/bid/10662/info BasiliX Webmail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings. An attacker can exploit this issue to gain acces...

Virtual Programming VP-ASP Shoperror Script 4/5 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/10534/info A vulnerability exists in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in the 'shoperror.asp' script. An attacker can exploit...

CitrusDB 0.3.6 - Remote Authentication Bypass

source: https://www.securityfocus.com/bid/12560/info CitrusDB is reportedly affected by an authentication bypass vulnerability. This issue is due to the application using a static value during the creation of user cookie information. An attacker could exploit this vulnerability to log in as any...

CitrusDB 0.3.6 - Remote Authentication Bypass

CitrusDB 0.3.6 - Remote Authentication Bypass source: https://www.securityfocus.com/bid/12560/info CitrusDB is reportedly affected by an authentication bypass vulnerability. This issue is due to the application using a static value during the creation of user cookie information. An attacker could...

pod.board 1.1 Multiple Script XSS

The remote host is hosting the Pod.Board CGI suite, a set of PHP scripts designed to manage online forums. There is a cross-site scripting issue in this suite that could allow an attacker to steal the cookies of your legitimate users, by luring them into clicking on a rogue URL. %NASLMINLEVEL 703...

CVE-2002-1428

index.php in dotProject 0.2.1.5 allows remote attackers to bypass authentication via a cookie or URL with the usercookie parameter set to 1...

php dotProject by pass authentication

SCAN Associates Sdn Bhd Security Advisory Product: dotProject 0.2.1.5 possibly other Vendor URL: http://www.dotmarketing.org/dotproject/ Summary: php dotProject by pass authentication Author: pokleyzz [email protected], sk [email protected], shaharil [email protected]...

dotProject 0.2.1 - User Cookie Authentication Bypass

source: https://www.securityfocus.com/bid/5347/info dotproject is prone to an issue which may allow remote attackers to bypass authentication and gain administrative access to the software. This may be accomplished by submitting a maliciously crafted 'usercookie' value either manually or via...

dotProject 0.2.1 - User Cookie Authentication Bypass

dotProject 0.2.1 - User Cookie Authentication Bypass source: https://www.securityfocus.com/bid/5347/info dotproject is prone to an issue which may allow remote attackers to bypass authentication and gain administrative access to the software. This may be accomplished by submitting a maliciously...

CVE-2002-0097

Geeklog 1.3 allows remote attackers to hijack user accounts, including the administrator account, by modifying the UID of a user's permanent cookie to the target account...

CVE-2001-0897

The CVE-2001-0897 issue affects Infopop Ultimate Bulletin Board (UBB) versions prior to 5.47e. A cross-site scripting flaw allows remote attackers to steal user cookies by exploiting an [IMG] tag that references an about: URL with an onerror field. The vulnerability is tied to the HTML/img handli...

CVE-2001-0897

Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board UBB before 5.47e allows remote attackers to steal user cookies via an IMG tag that references an about: URL with an onerror field...