Xerver HTTP Server <= 4.32 - Remote Denial of Service

No description provided by source. Xerver HTTP Server = v4.32 Remote Denial of Service Found By: DrIDE Download: http://www.javascript.nu/xerver Tested On: Windows XPSP3 - Description - Xerver v4.32 is a Windows based HTTP server. This is the latest version of the application available. Xerver...

emailarchitect enterprise email server 10.0 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: EmailArchitect Enterprise Email Server Version: 10.0 Vendor Site: http://www.emailarchitect.net Software Download Link: http://www.emailarchitect.net/webapp/download/easetup.exe Timeline: 29...

ClonusWiki 0.5 Index.PHP HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24101/info ClonusWiki is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script...

Jupiter CMS <= 1.1.5 - Multiple XSS Attack Vectors

No description provided by source. Jupiter CMS = 1.1.5 multiple XSS attack vectors. Discovered by: Nomenumbra/0x4F4C Date: 3/11/2006 impact:high privilege escalation,site defacement Jupiter CMS http://www.highstrike.net/ is a dynamic CMS system like mambo or limbo, allowing users to subscribe and...

mod_security <= 2.1.0 (ASCIIZ byte) POST Rules Bypass Vulnerability

No description provided by source. modsecurity = 2.1.0 ASCIIZ byte POST Rules Bypass Vulnerability http://www.php-security.org/MOPB/BONUS-12-2007.html Affected is modsecurity = 2.1.0 Detailed information Detailed information When modsecurity receives a request it parses it into web application...

Spyce 2.1.3 spyce/examples/request.spy name Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/27898/info Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution. An attacker may leverage these issues to execute arbitrary script code in the...

Storesprite 7 Cross Site Scripting

Advisory ID: HTB23215 Product: Storesprite Vendor: Lamp Design Limited Vulnerable Versions: 7 and probably prior Tested Version: 7 Advisory Publication: May 14, 2014 without technical details Vendor Notification: May 14, 2014 Vendor Patch: June 19, 2014 Public Disclosure: June 25, 2014...

Flash content-type sniffing allows Cross Site Data Hijacking

As documented at http://blog.detectify.com/post/86298380233/the-pitfalls-of-allowing-file-uploads-on-your-website it is possible to upload a flash file to confluence with a different content-type than for flash and when embedded on an attacker's domain will be able to make requests to the...

OneThink内容管理框架官网储存型XSS攻击

简要描述： 此内容管理框架OneThink为ThinkPHP框架同公司产品。用到了ThinkPHP最新版本3.2。 详细说明： 今天刚开始分析该内容管理框架，说实话，很喜欢BootStrap，喜欢这款内容管理框架，所以决定与小伙伴一起为该内容管理框架的安全努力下去！继续以我的风格，先黑盒后白盒。 漏洞证明：...

openSUSE Security Update : seamonkey (openSUSE-SU-2014:0008-1)

This update fixes the following security issues with SeaMonkey : - update to SeaMonkey 2.23 bnc854370 - requires NSPR 4.10.2 and NSS 3.15.3.1 - MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous memory safety hazards - MFSA 2013-105/CVE-2013-5611 bmo771294 Application Installation doorhanger...

TweetDeck Taken Down in Wake of XSS Attacks

TweetDeck services have been disabled for the time being as Twitter tries to get a handle on a cross-site scripting vulnerability that caused mountains of consternation on the social networking platform this morning. We've temporarily taken TweetDeck services down to assess today's earlier securi...

Khan Academy: Suffix of url-path is vulnerable to XSS-attack

PoC http://smarthistory.khanacademy.org/Campin"alert/BigBear/.html Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them...

Cisco Security Manager Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient input validation of a parameter. An attacker could exploit this...

Fedora 19 : python-fedora-0.3.34-1.fc19 (2014-5948)

Fix two security issues for services using python-fedora's TG1 and flask helpers. The TG1 fix quotes variables that could have been used to launch an XSS attack. The flask fix addresses OpenID Covert Redirect for web services which use flaskfasopenid to authenticate against the Fedora Account...

Fedora 20 : python-fedora-0.3.34-1.fc20 (2014-5962)

Fix two security issues for services using python-fedora's TG1 and flask helpers. The TG1 fix quotes variables that could have been used to launch an XSS attack. The flask fix addresses OpenID Covert Redirect for web services which use flaskfasopenid to authenticate against the Fedora Account...

USN-2172-1: CUPS vulnerability

Alex Korobkin discovered that the CUPS web interface incorrectly protected against cross-site scripting XSS attacks. If an authenticated user were tricked into visiting a malicious website while logged into CUPS, a remote attacker could modify the CUPS configuration and possibly steal confidentia...

Mail.ru: Xss On http://my.mail.ru/

http://my.mail.ru/video/search? plyload "alert'XSS BY CK' Find ON screens hot...

Content Security Policy for data: documents not preserved by session restore — Mozilla

Security researcher Nicolas Golubovic reported that the Content Security Policy CSP of data: documents was not saved as part of session restore. If an attacker convinced a victim to open a document from a data: URL injected onto a page, this can lead to a Cross-Site Scripting XSS attack. The targ...

LiveZilla 5.1.2.0 Insecure password storage

Author: Jakub Zoczek [email protected] CVE Reference: CVE-2013-7033 Product: LiveZilla Vendor: LiveZilla GmbH http://livezilla.net Affected version: 5.1.2.0 Severity: Medium CVSSv2 Score: 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Status: Partly fixed 0x01 Background LiveZilla, the widely-used and trusted Liv...

CVE-2013-6992

Cross-site request forgery CSRF vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the aafireadco...