S21SEC-016 - Vignette SSI Injection

ID: S21SEC-016-en Title: Vignette SSI Injection Date: 15/03/2003 Status: Vendor contacted and solution available Scope: SSI Execution, In some cases Remote command execution Platforms: All Author: rpinuaga Location: http://www.s21sec.com/es/avisos/s21sec-016-en.txt Release: External S 2 1 S E C...

Vignette 45 - Cross-Site Scripting

Vignette 45 - Cross-Site Scripting source: https://www.securityfocus.com/bid/7687/info Vignette software has been reported prone to multiple cross-site scripting vulnerabilities. Reportedly the issue presents itself, because the Vignette software does not sufficiently sanitize HTML characters fro...

Vignette 4/5 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/7687/info Vignette software has been reported prone to multiple cross-site scripting vulnerabilities. Reportedly the issue presents itself, because the Vignette software does not sufficiently sanitize HTML characters from user-supplied data. It may be...

Vignette Story Server sensitive information disclosure (a040703-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Vignette Story Server sensitive information disclosure Release Date: 04/07/2003 Application: Vignette Story Server v4.1, 6 Platform: Windows / Unix Severity: A remote user can extract sessi...

Vignette StoryServer TCL Server Crash Information Disclosure

The remote host is running Vignette StoryServer, a web interface to Vignette's Content Management suite. A flaw in this product may allow an attacker to extract information about the other users session and other sensitive information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Dat...

Vignette StoryServer 4.1 - Sensitive Stack Memory Information Disclosure

source: https://www.securityfocus.com/bid/7296/info It has been reported that Vignette StoryServer, under some circumstances may reveal stack memory content. If a specially crafted request is made for a page that accepts user-supplied data an error state may be triggered. If the attack is...