paFileDB category.php start Variable XSS

Network Security News – Friday, May 06, 2005 Events

paFileDB category.php start Variable XSS

paFileDB contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'start' variables upon submission to the 'category.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/14842

paFileDB viewall.php start Variable XSS

paFileDB contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'start' variables upon submission to the 'viewall.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/14841

paFileDB category.php start Parameter SQL Injection

paFileDB contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to the 'start' parameter in the 'category.php' script not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.. Read more at osvdb.org/14840

paFileDB viewall.php start Parameter SQL Injection

paFileDB contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to the 'start' parameter in the 'viewall.php' script not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.. Read more at osvdb.org/14839

Web Crossing webx XSS

Web Crossing contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user-supplied input upon submission to the 'webx' component. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/16070

CoolForum register.php login Parameter SQL Injection

CoolForum contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to the 'login' parameter in the 'register.php' script not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.. Read more at osvdb.org/14953

CoolForum entete.php pseudo Parameter SQL Injection

CoolForum contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to the 'pseudo' parameter in the 'entete.php' script not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.. Read more at osvdb.org/14952

CoolForum avatar.php img Variable XSS

CoolForum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'img' variables upon submission to the 'avatar.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/14951

Mac OS X vpnd Local Overflow

A local overflow exists in Mac OS X when configured as a VPN server. vpnd fails to validate user-supplied input to the Server_id parameter resulting in a buffer overflow. With a specially crafted request, a malicious user can execute arbitrary code resulting in a loss of integrity.. Read more at osvdb.org/16085

Mac OS X chfn/chpass/chsh Privilege Escalation

Mac OS X contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered by an unspecified flaw in chfn, chpass and chsh, which run SUID. This flaw may lead to a loss of integrity. No further details have been provided.. Read more at osvdb.org/16075