SuSE 10 Security Update : Tomcat 5 (ZYPP Patch Number 6352)

This update of tomcat fixes several vulnerabilities : - RequestDispatcher usage can lead to information leakage. CVE-2008-5515 - denial of service via AJP connection. CVE-2009-0033 - some authentication classes allow user enumeration. CVE-2009-0580 - XSS bug in example application cal2.jsp...

XSS bug in wiki markup link rendering

The following wikimarkup creates links with an onclick event. noformat test link|mailto:[email protected]" onclick="alert'hi. I am a fun onclick event' test link|mailto:[email protected]" onclick="alert'hi. I am a fun onclick event' noformat This is due to the following code in...

XSS bug in wiki markup link rendering

The following wikimarkup creates links with an onclick event. noformat test link|mailto:[email protected]" onclick="alert'hi. I am a fun onclick event' test link|mailto:[email protected]" onclick="alert'hi. I am a fun onclick event' noformat This is due to the following code in...

cpanel11183-xss.txt

Hello I Discovered a new bug in cPanel xss Exploit : http://example.com:2082/frontend/x/manpage.html?XSS Example : 1- http://example.com:2082/frontend/x/manpage.html?alertLeZr 2- http://example.com:2082/frontend/x/manpage.html?alertdocument.cookie tested on: cPanel V 11.18.3 cPanel V 11.21.0-BETA...

VTLS Web Gateway 48.1 - 'Searchtype' Cross-Site Scripting

source: https://www.securityfocus.com/bid/26419/info Web Gateway is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context o...

lightblog-xss.txt

Application: Light Blog Web Site: http://www.publicwarehouse.co.uk/phpscripts/lightblog.php Versions: 4.1 Platform: linux, windows, freebsd, sun Bug: Cross site Scripting XSS Fix Available: Yes fixed with the Same version number. download file now called LightBlog.zip instead of Light.zip Advisor...

XSS bug: usernames not HTML-encoded in all places

When signing up for an account, it is possible to enter a username like "fred". Confluence will accept this, and on certain pages, render it as raw HTML to the user, opening the possibility of cross-site scripting XSS attacks. Two places I've spotted the raw HTML so far: - Most prominently, when ...

vtforum-13.txt

LiderHack.Org script name : Vt-Forum Lite System V.1.3 Script Download : http://aspindir.com/indir.asp?id=585 Risk : High Found By : St@rExT Thanks : Dekolax , ShaFuck31 , ST@ReXT , Dekolax , SwatHack , Maverick , Candark , Torlaq , Woheras , Siruas Vulnerable file : vfinfo.asp XSS Bug:...

XSS Bug in Cherokee Webserver

Tuesday 4 of April of 2006, I have detected that it is possible to mount an attack of the type Cross Site Scripting XSS in cherokee-0.5.0 and all previous versions. The problem resides, when introducing code HTML in the URL. Because previously, it was let now of a seemed failure, from version 0.4...

[KAPDA::#26]vBulletin.3.5.3~3.0.12-XSS

original advisories: http://www.kapda.ir/advisory-266.html http://myimei.com/security/2006-02-19/vbulletin3012353svalidemailxss-attack.html KAPDA New advisory Software: vBulletin Vendor: http://www.vBulletin.com Versions: 3.0.12-3.5.3 Class: Remote Status: Unpatched Exploit: Available Solution:...

exponentCMS.txt

A number of security issues have been discovered in ExponentCMS ------------------------------------------------------------------------ --------------------- Exponent is a fully-featured, modern CMS written in PHP, that enables non-technical people to manage and update their websites with minima...

jawsGlossary.txt

XSS Bug in Jaws Glossary v 0.4 - 0.5.1 latest version STATUS: The vendor has been contacted, fixed in cvs. Jaws is a Framework and Content Management System for building dynamic web sites. It aims to be User Friendly giving ease of use and lots of ways to customize web sites, but at the same time...

[XSS] PHP-Nuke 7.4 DelAdmin Bug

CODEBUG Labs Advisory 2 Title: DelAdmin Bug Author: Pierquinto 'Mantra' Manco Product: PHP-Nuke 7.4 Type: XSS Web: http://www.mantralab.org Delete Admin Bug - Description PHP-Nuke is a very bugged web CMS, version 7.4 has critical XSS bug that permit to an attacker to delete any Admin account...

[waraxe-2004-SA#009 - Non-critical Sql injection and XSS bug in PhpBB 2.0.6c]

================================================================================ waraxe-2004-SA009 ================================================================================ Non-critical Sql injection and XSS bug in PhpBB 2.0.6c...

03-02-04 XSS Bug in NetScreen-SA 5000 Series of SSL VPN appliance

TITLE: 03-02-04 XSS Bug in NetScreen-SA 5000 Series of SSL VPN appliance SUMMARY Cross Site Scripting bug in the 'delhomepage.cgi' CGI binary in the NetScreen-SA 5000 Series SSL VPN appliance. DETAILS There exists a cross-site scripting bug in 'row' parameter of the 'delhomepage.cgi' CGI binary...

InterForum v.1.0.0 BETA 1 many holes

InterForum v.1.0.0 BETA 1 many holes Founder : MaskNBTA -- [email protected] Date : 6/18/2003 Version : 1.0 Beta 1 maybe all below version Problems : + XSS bug + Read private message ' s another account + Change profile ' s another account ---- access admin panel 1/ XSS bug : In...

XSS and PHP include bug in W-Agora

I have found some bugs in W-Agora's forum configuration filesystem. In the page editform.php, an admin or root user can open any file, with the "PHP Include bug". A sample of the script: editform.php ?php the script gets the parameter "file", puts ".php" after this, and includes the file in the...