XSS in bookmarks plugin

The bookmarking code under the url http://localhost:8080/plugins/socialbookmarking/updatebookmark.action is vulnerable to XSS attacks using the spaceKey parameter: submitting the following code will execute javascript: spaceKey=%22%3E%3Cscript%3Ealertdocument.cookie%3C/script%3E%22%3E IMPORTANT:...

Fixed in Apache Tomcat 5.5.27

Low: Cross-site scripting CVE-2008-1232 The message argument of HttpServletResponse.sendError call is not only displayed on the error page, but is also used for the reason-phrase of HTTP response. This may include characters that are illegal in HTTP headers. It is possible for a specially crafted...

IGES CMS <= 2.0 (XSS/SQL) Multiple Remote Vulnerabilities

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: IGES CMS =2.0 Multiple Vulnerabilities Vendor: www.iges.nl Exploit: Available Vulnerable Version: 2.0 Impact: High Fix: N/A 1. Description: IGES CMS is a complete, fully featured CMS in PHP language with S...

SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5405)

Mozilla Firefox was updated to version 2.0.0.15, fixing various bugs including following security bugs : - Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory...

Mozilla Foundation Security Advisory 2008-22

Mozilla Foundation Security Advisory 2008-22 Title: XSS through JavaScript same-origin violation Impact: High Announced: July 1, 2008 Reporter: mozbugra4 Products: Firefox, SeaMonkey Fixed in: Firefox 3.0 Firefox 2.0.0.15 SeaMonkey 1.1.10 Description Mozilla contributor mozbugra4 submitted a set ...

mybloggie-sql.txt

netVigilance Security Advisory 40 myBloggie version 2.1.6 Multiple SQL Injection Vulnerability Description: myBloggie http://mywebland.com/mybloggie/ is considered one of the most simple, user-friendliest yet packed with features Weblog system available to date. Built using PHP & mySQL, web most...

faname10-xss.txt

netVigilance Security Advisory 43 Fa Name version 1.0 Multiple XSS Attack Vulnerabilities Description: Fa Name http://webscripts.softpedia.com/script/Content-Management/Fa-Name-41229.html is useful portal CMS for .name websites. You can have a simple portal but useful one for you domain names and...

myBloggie 2.1.6 Multiple Remote SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications ============================================================= myBloggie 2.1.6 Multiple Remote SQL Injection Vulnerabilities ============================================================= netVigilance Security Advisory 40 myBloggie version...

MyBloggie 2.1.6 - Multiple SQL Injections

MyBloggie 2.1.6 - Multiple SQL Injections netVigilance Security Advisory 40 myBloggie version 2.1.6 Multiple SQL Injection Vulnerability Description: myBloggie http://mywebland.com/mybloggie/ is considered one of the most simple, user-friendliest yet packed with features Weblog system available t...

Exploit for vBulletin "obscure" XSS (3.7.1 & 3.6.10)

====================================================================== Advisory : Exploit for vBulletin "obscure" XSS Release Date : June 13th 2008 Application : vBulletin Version : vBulletin 3.7.1 and lower, vBulletin 3.6.10 and lower Platform : PHP Vendor URL : http://www.vbulletin.com/ Authors...

omerta-xss.txt

original advisory at http://www.davidsopas.com/soapbox/omertaxss.txt XSS flaws in Omerta script www.barafranca.com version tested: 2.7c and 2.8newer version by David Sopas Ferreira Found and reported at : 5-05-2008PT Full disclosure at : 12-05-2008PT...

CVE-2008-1216

IBM Lotus Quickr 8.0 server, and possibly QuickPlace 7.x, does not properly identify URIs containing cross-site scripting XSS attack strings, which allows remote attackers to inject arbitrary web script or HTML via a Calendar OpenDocument action to main.nsf with a Count parameter containing a...

smartermail-xss.txt

Product: SmarterMail Enterprise 4.3 Web product: http://www.smartertools.com/Products/SmarterMail/O verview.aspx web product demo: http://maildemo.smartertools.com/Login.aspx Apparently this webmail is vulnerable to an attack xss very dangerous because it runs automatically when you open the inbo...

SmarterMail Enterprise 4.3 - malformed mail XSS

Product: SmarterMail Enterprise 4.3 Web product: http://www.smartertools.com/Products/SmarterMail/O verview.aspx web product demo: http://maildemo.smartertools.com/Login.aspx Apparently this webmail is vulnerable to an attack xss very dangerous because it runs automatically when you open the inbo...

CVE-2008-0005

modproxyftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting XSS attacks using UTF-7 encoding...

SuSE 10 Security Update : apache2 (ZYPP Patch Number 4669)

Several bugs were fixed in the Apache2 webserver : These include the following security issues : - modstatus: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset 'detection'. CVE-2006-5752 - modcache: Prevent a...

openSUSE 10 Security Update : apache2 (apache2-4666)

Several bugs were fixed in the Apache2 webserver : These include the following security issues : - CVE-2006-5752: modstatus: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset 'detection'. - CVE-2007-1863:...

foxnews-xss.txt

Foxnews 0day XSS Shock Attack Demo link to send to a fish: http://www.foxnews.com/video2/launchPage.html?http://localhost/ With netcat listen on localhost : listening on any 80 ... connect to localhost 127.0.0.1 from localhost 127.0.0.1 1964 GET...

vtls-xss.txt

============================================= INTERNET SECURITY AUDITORS ALERT 2006-004 - Original release date: April 18, 2006 - Last revised: November 13, 2007 - Discovered by: Jesus Olmos Gonzalez - Severity: 1/5 ============================================= I. VULNERABILITY...

SAXON version 5.4 XSS Attack Vulnerability

netVigilance Security Advisory 54 SAXON version 5.4 XSS Attack Vulnerability Description: SAXON is a simple accessible online news publishing system for personal and small corporate site owners. Publish news, using configurable templates, on any .php page on your site. Publish news on a 'per...