diff --git a/files.csv b/files.csv index 56f381afb..23ec2adf6 100755 --- a/files.csv +++ b/files.csv @@ -31406,3 +31406,11 @@ id,file,description,date,author,platform,type,port 34876,platforms/php/webapps/34876.txt,"E-Gold Game Series: Pirates of The Caribbean Multiple SQL Injection Vulnerabilities",2009-08-27,Moudi,php,webapps,0 34877,platforms/php/webapps/34877.txt,"DigiOz Guestbook 1.7.2 'search.php' Cross Site Scripting Vulnerability",2009-08-26,Moudi,php,webapps,0 34878,platforms/php/webapps/34878.txt,"StandAloneArcade 1.1 'gamelist.php' Cross Site Scripting Vulnerability",2009-08-27,Moudi,php,webapps,0 +34881,platforms/linux/remote/34881.html,"Mozilla Firefox SeaMonkey <= 3.6.10 and Thunderbird <= 3.1.4 'document.write' Memory Corruption Vulnerability",2010-10-19,"Alexander Miller",linux,remote,0 +34882,platforms/php/webapps/34882.html,"sNews 1.7 'snews.php' Cross Site Scripting and HTML Injection Vulnerabilities",2010-10-19,"High-Tech Bridge SA",php,webapps,0 +34883,platforms/php/webapps/34883.txt,"4Site CMS 2.6 'cat' Parameter SQL Injection Vulnerability",2010-10-19,"High-Tech Bridge SA",php,webapps,0 +34884,platforms/php/webapps/34884.txt,"JCE-Tech SearchFeed Script 'index.php' Cross Site Scripting Vulnerability",2009-08-26,Moudi,php,webapps,0 +34885,platforms/php/webapps/34885.txt,"Auction RSS Content Script rss.php id Parameter XSS",2009-08-26,Moudi,php,webapps,0 +34886,platforms/php/webapps/34886.txt,"Auction RSS Content Script search.php id Parameter XSS",2009-08-26,Moudi,php,webapps,0 +34887,platforms/php/webapps/34887.txt,"JCE-Tech PHP Video Script 'index.php' Cross Site Scripting Vulnerability",2009-08-26,Moudi,php,webapps,0 +34888,platforms/php/webapps/34888.html,"sNews 1.7 'snews.php' Cross Site Scripting and HTML Injection Vulnerabilities",2010-10-19,"High-Tech Bridge SA",php,webapps,0 diff --git a/platforms/linux/remote/34881.html b/platforms/linux/remote/34881.html new file mode 100755 index 000000000..5b2ce446d --- /dev/null +++ b/platforms/linux/remote/34881.html @@ -0,0 +1,40 @@ +source: http://www.securityfocus.com/bid/44247/info + +Mozilla Firefox, Thunderbird, and Seamonkey are prone to a memory-corruption vulnerability because they fail to adequately validate user-supplied data. + +Successful exploits may allow an attacker to execute arbitrary code in the context of the user running an affected application. Failed exploit attempts will result in a denial-of-service condition. + +This issue affects versions prior to: + +Firefox 3.6.11 +Firefox 3.5.14 +Thunderbird 3.1.5 +Thunderbird 3.0.9 +SeaMonkey 2.0.9 + +NOTE: This issue was previously discussed in 44228 (Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-64/65/66/67/68/69/71/72 Multiple Vulnerabilities) but has been given its own record to better document it. + + + + + + + + + + diff --git a/platforms/php/webapps/34882.html b/platforms/php/webapps/34882.html new file mode 100755 index 000000000..e3ff942a8 --- /dev/null +++ b/platforms/php/webapps/34882.html @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/44255/info + +sNews is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. + +Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. + +sNews 1.7 is vulnerable; other versions may also be affected. + +
\ No newline at end of file diff --git a/platforms/php/webapps/34883.txt b/platforms/php/webapps/34883.txt new file mode 100755 index 000000000..f0e32a1b6 --- /dev/null +++ b/platforms/php/webapps/34883.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/44258/info + +4Site CMS is prone to an SQL-injection vulnerability. + +An attacker can exploit this issue to carry out unauthorized actions on the underlying database which may compromise the application and may aid in further attacks. + +4Site CMS 2.6 is vulnerable; other versions may also be affected. + +http://www.example.com/catalog/index.shtml?cat=-1+UNION+SELECT+@@version \ No newline at end of file diff --git a/platforms/php/webapps/34884.txt b/platforms/php/webapps/34884.txt new file mode 100755 index 000000000..4a0b5b22e --- /dev/null +++ b/platforms/php/webapps/34884.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/44266/info + +JCE-Tech SearchFeed Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + + http://www.example.com/index.php?search="> \ No newline at end of file diff --git a/platforms/php/webapps/34885.txt b/platforms/php/webapps/34885.txt new file mode 100755 index 000000000..02437f99d --- /dev/null +++ b/platforms/php/webapps/34885.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/44267/info + +JCE-Tech Auction RSS Content Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/rss.php?id="> \ No newline at end of file diff --git a/platforms/php/webapps/34886.txt b/platforms/php/webapps/34886.txt new file mode 100755 index 000000000..dba05ec58 --- /dev/null +++ b/platforms/php/webapps/34886.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/44267/info + +JCE-Tech Auction RSS Content Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/search.php?id="> \ No newline at end of file diff --git a/platforms/php/webapps/34887.txt b/platforms/php/webapps/34887.txt new file mode 100755 index 000000000..022eba307 --- /dev/null +++ b/platforms/php/webapps/34887.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/44269/info + +JCE-Tech PHP Video Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/index.php?key="> \ No newline at end of file diff --git a/platforms/php/webapps/34888.html b/platforms/php/webapps/34888.html new file mode 100755 index 000000000..e3ff942a8 --- /dev/null +++ b/platforms/php/webapps/34888.html @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/44255/info + +sNews is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. + +Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. + +sNews 1.7 is vulnerable; other versions may also be affected. + +
\ No newline at end of file