Cross site scripting

Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting XSS attacks or execute arbitrary Expression Language EL statements via vectors that...

[Wintercore Research] Consona Products - Multiple vulnerabilities

Affected products: Consona Live Assistance Consona Dynamic Agent Consona Subscriber Assistance Vulnerabilities: -XSS -Remote Code Execution -Buffer Overflow -Privilege escalation Executive summary: Consona products uses a propietary ActiveX site-lock mechanism that can be defeated through XSS...

Joomla! Component Table JX - Cross-Site Scripting

Joomla! Component Table JX - Cross-Site Scripting Exploit Title: Joomla Component Table JX XSS Vulnerabilities Date: 01.05.2010 Author: Valentin Category: webapps/0day Code : :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Tit...

XSS Bookmark vulnerabilities

The Add bookmark page is vulnerable to XSS attacks...

XSS Bookmark vulnerabilities

The Add bookmark page is vulnerable to XSS attacks...

New Class of XSS Attacks Emerging

A new type of cross-site scripting XSS attack that exploits commonly used network administration tools could be putting users’ data at risk, a researcher says. Read the full article. Dark Reading...

openSUSE Security Update : rubygem-actionpack (rubygem-actionpack-1946)

This update of rubygems fixes two vulnerabilities : - CVE-2008-7248: CVSS v2 Base Score: 4.3 Rails CSRF protection can be bypassed by using special content-types for a HTTP request. - CVE-2009-4214: CVSS v2 Base Score: 4.3 The method striptags does not completely protect against XSS attacks...

CVE-2010-0716

layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files aka attachments, which allows remote authenticated users to leverage same-origin relationships and...

MOJOs IWms 7 - SQL Injection Cross-Site Scripting

MOJOs IWms 7 - SQL Injection Cross-Site Scripting Exploit Title: MOJO's IWMS | www.DigitalWhisper.co.il Software Link: http://www.mojo.co.il Version: YourXSSHere SQL Injection A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the...

Mojo's IWMS 7 SQL Injection / Cross Site Scripting

Exploit Title: MOJO's IWMS | www.DigitalWhisper.co.il Software Link: http://www.mojo.co.il Version: YourXSSHere SQL Injection A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can re...

Facebook Cross Site Scripting

============================================= INTERNET SECURITY AUDITORS ALERT 2010-001 - Original release date: January 8th, 2010 - Last revised: February 3rd, 2010 - Discovered by: Juan Galiana Lara - Severity: 6.3/10 CVSS Base Score ============================================= I. VULNERABILIT...

Joomla JVClouds3D Cross Site Scripting / HTML Injection

Hello Bugtraq! I want to warn you about Cross-Site Scripting vulnerability in JVClouds3D modjvclouds3D plugin for Joomla. Which I found at 08.01.2010. It is similar to XSS vulnerability in Joomulus for Joomla http://websecurity.com.ua/3801/. About millions of flash files tagcloud.swf which are...

dotProject 2.1.3 - Multiple SQL Injections HTML Injection Vulnerabilities

dotProject 2.1.3 - Multiple SQL Injections HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/37669/info dotProject is prone to multiple SQL-injection and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage t...

dotProject 2.1.3 - Multiple SQL Injections / HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/37669/info dotProject is prone to multiple SQL-injection and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser o...

CVE-2009-4074

The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to leverage the "response-changing mechanism" to conduct cross-site scripting XSS attacks against web sites that have no inherent XSS vulnerabilities, related to the details of output encoding and improper modification of an...

CVE-2009-4071

CVE-2009-4071 affects the Opera web browser (notably Opera on Linux/Unix paths in the connected records) where, when exception stacktraces are enabled, scripting error messages from a site can be read by a different site, enabling information disclosure and cross-site scripting via unspecified ve...

Bug in IE 8 Causes XSS Errors

The latest version of Microsoft’s Internet Explorer browser contains a bug that can enable serious security attacks against websites that are otherwise safe. The flaw in IE 8 can be exploited to introduce XSS, or cross-site scripting, errors on webpages that are otherwise safe. Read the full...

openSUSE Security Update : opera (opera-1532)

Version upgrade of Opera to 10.1 to fix : - CVE-2009-3265: CVSS v2 Base Score: 4.3 CVE-2009-3266: CVSS v2 Base Score: 4.3 two XSS attacks via RSS/Atom - CVE-2009-3831: CVSS v2 Base Score: 9.3 possible remote arbitrary code execution via crafted domain names %NASLMINLEVEL 70300 C Tenable Network...

openSUSE Security Update : opera (opera-1532)

Version upgrade of Opera to 10.1 to fix : - CVE-2009-3265: CVSS v2 Base Score: 4.3 CVE-2009-3266: CVSS v2 Base Score: 4.3 two XSS attacks via RSS/Atom - CVE-2009-3831: CVSS v2 Base Score: 9.3 possible remote arbitrary code execution via crafted domain names %NASLMINLEVEL 70300 C Tenable Network...

openSUSE Security Update : opera (opera-1532)

Version upgrade of Opera to 10.1 to fix : - CVE-2009-3265: CVSS v2 Base Score: 4.3 CVE-2009-3266: CVSS v2 Base Score: 4.3 two XSS attacks via RSS/Atom - CVE-2009-3831: CVSS v2 Base Score: 9.3 possible remote arbitrary code execution via crafted domain names %NASLMINLEVEL 70300 C Tenable Network...