CVE-2011-2224

The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

Cross site scripting

The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

Apple Safari Update Fixes 58 Bugs, Adds Sandboxing

Along with the release of their new Lion OS X, Apple has issued a new version of its Safari browser for Mac and Windows users, pushing version 5.1 and 5.0.6 to patch a boatload of security holes, some of which are critical. Fifty-eight security vulnerabilities in total are addressed in the update...

Cross Site Scripting - Dokumentation, Analyse & Techniken

Document Title: =============== Cross Site Scripting - Dokumentation, Analyse & Techniken References: =========== http://www.vulnerability-lab.com/resources/documents/198.pdf http://de.wikipedia.org/wiki/Cross-SiteScriptingWeblinks ; Release Date: ============= 2011-07-19 Vulnerability Laboratory...

CVE-2011-2197

The cross-site scripting XSS prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a...

CVE-2011-1894

The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for embedded content in an HTML document, which allows...

Mitel Audio And Web Conferencing 4.4.30 Cross Site Scripting

PR10-15: Multiple XSS flaws within Mitel's AWC Mitel Audio and Web Conferencing Vulnerability found: 21st July 2010 Vendor informed: 26th July 2010 Vulnerability fixed: Severity: High Description: Mitel Audio and Web Conferencing AWC are a simple, cost-effective and scalable audio and web...

PR10-15: Multiple XSS flaws within Mitel's AWC (Mitel Audio and Web Conferencing)

PR10-15: Multiple XSS flaws within Mitel's AWC Mitel Audio and Web Conferencing Vulnerability found: 21st July 2010 Vendor informed: 26th July 2010 Vulnerability fixed: Severity: High Description: Mitel Audio and Web Conferencing AWC are a simple, cost-effective and scalable audio and web...

CVE-2011-1579

The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets CSS token sequences, which allows remote attackers to conduct cross-site scripting XSS attacks or obtain sensitive information by using the \2f\2a an...

FreeBSD : OTRS -- Several XSS attacks possible (a4372a68-652c-11e0-a25a-00151735203a)

OTRS Security Advisory reports : - Several XSS attacks possible : An attacker could trick a logged in user to following a prepared URL inside of the OTRS system which causes a page to be shown that possibly includes malicious !JavaScript code because of incorrect escaping during the generation of...

CVE-2011-1401

ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted Cascading Style Sheets CSS token sequences in 1 the default...

Six Apart Movable Type Multiple Vulnerabilities (Apr 2011)

Six Apart Movable Type is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sixapart:movabletype...

Report: DDoS Attacks On the Rise in 2011

Distributed denial-of-service DDoS attacks are on the rise, according to a report released by Trustwave this week. The company’s semi-annual Web Hacking Incident Database WHID report found the attacks jumped 22 percent from the first half of 2010, overtaking methods such as SQL injections and...

tudou.com UTF7-BOM Cross Site Scripting

xss attacks through utf7-BOM string injection the beginning of the utf-7 BOM chascter is from Gareth Heyes's paper 《XSS Lightsabre techniques》 ---------------------start---------------------------------- CSS expressions with UTF-7 • UTF-7 BOM character can force UTF-7 in a external style sheet •...

N-13 News CSRF Vulnerability

N-13 News is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-0771

The Janrain Engage formerly RPX module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting XSS attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login...

CVE-2010-4567

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a 1 javascript: or 2 data: URI, which allows remote attackers to conduct cross-site scripting XSS attacks via the URL aka bugfileloc field...

glfusion CMS 1.2.1 - img Persistent Cross-Site Scripting

glfusion CMS 1.2.1 - img Persistent Cross-Site Scripting Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easi...

glfusion CMS 1.2.1 - 'img' Persistent Cross-Site Scripting

Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easily create websites and online communities complete with...

Mandriva Update for firefox MDVSA-2010:251-2 (firefox)

Check for the Version of firefox OpenVAS Vulnerability Test Mandriva Update for firefox MDVSA-2010:251-2 firefox Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...