evoBlog Remote Name tag Script injection

DESCRIPTION evoBlog is prone to HTML injection attacks. It is possible for a malicious evoBlog user to inject hostile HTML and script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of evoBlog. evoBlog does not adequately...

Zoomblog HTML Injection Vulnerability

DESCRIPTION Zoomblog is prone to HTML injection attacks. It is possible for a malicious Zoomblog user to inject hostile HTML and script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of Zoomblog. Zoomblog does not adequate...

Zoomblog <IMG> BBCode Tag JavaScript Injection Vulnerability

DETAILS Zoomblog is prone to javascript injection attacks. Zoomblog does not adequately filter img tags from various fields. It is possible for a malicious Zoomblog user to inject hostile javascript code into the commentary via form fields. This code may be rendered in the browser of a web user w...

Chora Remote Code Execution Vulnerability

The remote server is running at least one instance of Chora version 1.2.1 or earlier. Such versions have a flaw in the diff viewer that enables a remote attacker to run arbitrary code with the permissions of the web user. OpenVAS Vulnerability Test $Id: choraremotecodeexecution.nasl 7221 2017-09-...

IlohaMail Arbitrary File Access via Language Variable

The target is running at least one instance of IlohaMail version 0.7.10 or earlier. Such versions contain a flaw in the processing of the language variable that allows an unauthenticated attacker to retrieve arbitrary files available to the web user. SPDX-FileCopyrightText: 2004-2005 George A...

IlohaMail External Programs Vulnerabilities

The target is running at least one instance of IlohaMail version 0.8.6. This version may contain flaws in the spell check and GnuPG features that allow an authenticated attacker to run arbitrary commands with the privileges of the web user simply by enclosing them in backticks when spell checking...

sparkleBlogXSS.txt

SparkleBlog is prone to HTMl injection attacks. It is possible for a malicious SparkleBlog user to inject hostile HTML script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of SparkleBlog. SparkleBlog does not adequately...

SparkleBlog Journal.php HTML Injection Vulnerability =>v2.1 (all versions vulnerable)

SparkleBlog is prone to HTMl injection attacks. It is possible for a malicious SparkleBlog user to inject hostile HTML script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of SparkleBlog. SparkleBlog does not adequately...

Zomplog Script Injection Vulnerability =>3.4 (all versions vulnerable)

zomplog is prone to xss injection attacks. It is possible for a malicious zomplog user to inject hostile xss and script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of zomplog. zomplog does not adequately filter xss tags...

Aprox PHP Portal index.php Arbitrary File View

The remote host is running Aprox Portal - a PHP-based content management system. There is a bug in this software that may allow an attacker to read arbitrary files on the remote web server with the privileges of the web user. In addition, this software is reportedly vulnerable to a local file...

H-Sphere 2.x - HTML Template Inclusion Cross-Site Scripting

source: https://www.securityfocus.com/bid/7855/info H-Sphere is prone to multiple cross-site scripting vulnerabilities via the HTML template feature in the Hosting Control Panel. HTML and script code will not be filtered from pages which are generated when a request for an invalid or unknown...

Bandmin 1.4 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/7729/info It has been reported that a cross-site scripting vulnerability exists in Bandmin. Because of this, an attacker may be able to execute script code or HTML in the context of the site hosting Bandmin by enticing a web user to follow a malicious lin...

Python 2.2/2.3 - Documentation Server Error Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/7353/info It has been reported that the Python Documentation Server is vulnerable to a cross-site scripting problem in error pages. Because of this, an attacker could potentially cause the execution of malicious HTML and script code in the browser of a we...

Authoria HR Suite - AthCGI.exe Cross-Site Scripting

Authoria HR Suite - AthCGI.exe Cross-Site Scripting source: https://www.securityfocus.com/bid/5932/info Authoria HR Suite is prone to cross-site scripting attacks. An attacker could construct a malicious link to a vulnerable host that contains arbitrary HTML and script code. If this link is visit...

Mewsoft NetAuction 3.0 - Cross-Site Scripting

Mewsoft NetAuction 3.0 - Cross-Site Scripting source: https://www.securityfocus.com/bid/5023/info NetAuction does not filter HTML code from URI parameters, making it prone to cross-site scripting attacks. Attacker-supplied HTML code may be included in a malicious links. The attacker-supplied HTML...

ColdFusion MX - Missing Template Cross-Site Scripting

ColdFusion MX - Missing Template Cross-Site Scripting source: https://www.securityfocus.com/bid/5011/info ColdFusion MX is prone to cross site scripting attacks. Attacker-supplied script code may be included in a malicious missing template URI generated by the default Missing Template handler of...

PHPBB2 - Image Tag HTML Injection

source: https://www.securityfocus.com/bid/4858/info It is possible to inject arbitrary HTML into phpBB2 forum messages via the use of BBCode image tags. A similar issue is described in Bugtraq ID 4379 "PHPBB Image Tag User-Embedded Scripting Vulnerability". However, phpBB2 was found to not be...

Htgrep CGI Arbitrary File Viewing Vulnerability

Software: Htgrep URL: http://www.iam.unibe.ch/scg/Src/Doc/ Version: All Versions Platforms: Unix maybe Winnt? Author status: Notified Summary: Any remote user can view arbitrary files on the system with the privileges of the web user Vulnerability: The CGI allows a user to specify a header and...