1084 matches found
[SA18544] MyBB "Allow HTML in Signatures" Script Insertion Security Issue
TITLE: MyBB "Allow HTML in Signatures" Script Insertion Security Issue SECUNIA ADVISORY ID: SA18544 VERIFY ADVISORY: http://secunia.com/advisories/18544/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: MyBB formerly MyBulletinBoard 1.x...
[SA18309] Next Generation Image Gallery "page" Cross-Site Scripting Vulnerability
TITLE: Next Generation Image Gallery "page" Cross-Site Scripting Vulnerability SECUNIA ADVISORY ID: SA18309 VERIFY ADVISORY: http://secunia.com/advisories/18309/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: Next Generation Image Gallery 0.x...
CVE-2001-1513
Macromedia JRun 3.0 and 3.1 allows remote attackers to obtain duplicate active user session IDs and perform actions as other users via a URL request for the web application directory without the trailing '/' slash, as demonstrated using ctx...
CVE-2005-0201
D-BUS dbus before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket...
DEBIAN-CVE-2005-0201
D-BUS dbus before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket...
USN-144-1: dbus vulnerability
Besides providing the global system-wide communication bus, dbus also offers per-user "session" buses which applications in an user's session can create and use to communicate with each other. Daniel Reed discovered that the default configuration of the session dbus allowed a local user to connec...
Mandrake Linux Security Advisory : dbus (MDKSA-2005:105)
Dan Reed discovered a vulnerability in the D-BUS system for sending messages between applications. He found that a user can send and listen to messages on another user's per-user session bus if they knew the address of the socket. The updated packages have been patched to correct this problem...
security flaw
D-BUS dbus before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket...
Low: Red Hat Security Advisory: dbus security update.
Updated dbus packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. D-BUS is a system for sending messages between applications. It is used both for the systemwide message...
CVE-2004-2109
Multiple cross-site scripting XSS vulnerabilities in 1 imagezoom.asp or 2 recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL...
CVE-2001-1476
CVE-2001-1476: SSH implementations prior to 2.0 using RC4 with the disallow NULL passwords option are vulnerable to remote session replay that can reveal parts of user passwords via modified attempts and the login message behavior. Root cause is a flaw in session handling under these conditions, ...
[SA15009] CityPost Automated Link Exchange "msg" Cross-Site Scripting
---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: CityPost Automated Link Exchange "msg" Cross-Site...
[PersianHacker.NET 200503-10]PHP-Fusion v5.01 Html Injection Vulnerability
PersianHacker.NET 200503-10PHP-Fusion v5.01 Html Injection Vulnerability Date: 2005 March Bug Number: 10 PHP-Fusion a light-weight open-source content management system CMS written in PHP. It utilises a mySQL database to store your site content and includes a simple, comprehensive adminstration...
Multiple devices process HTTP requests inconsistently
Overview Multiple interconnected devices process valid HTTP request headers inconsistently and in this may manner may allow a remote attacker to poison a cache, conduct cross-site scripting attacks, and hijack user sessions. Attackers may use these flaws to launch a class of attacks referred to a...
CVE-2004-2109
Multiple cross-site scripting XSS vulnerabilities in 1 imagezoom.asp or 2 recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL...
XXS in SCT email client
Vendor : SCT URL : http://www.SCT.com/ Version: Campus Pipeline Risk : Cross site scripting Description: Fusetalk SCT Campus Pipeline is the Web platform of choice at over 175 institutions. It improves efficiency, builds community, and provides freedom of choice by integrating disparate systems a...
[ GLSA 200408-23 ] kdelibs: Cross-domain cookie injection vulnerability
Gentoo Linux Security Advisory GLSA 200408-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...
Vignette StoryServer Cross-user Session Information Disclosure
Binary data 1458.prm...
WebCortex Webstores2000 version 6.0 multiple security vulnerabilities
S-Quadra Advisory 2004-02-18 Topic: WebCortex Webstores2000 version 6.0 multiple security vulnerabilities Severity: High Vendor URL: http://www.webcortex.com Advisory URL: http://www.s-quadra.com/advisories/Adv-20040218.txt Release date: 18 Feb 2004 1. DESCRIPTION Webstores2000 is a complete...