Network Security News Monitor - Wednesday, March 08, 2006 Events

Lurker Unspecified XSS

Lurker contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified or unknown variables upon submission to an unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more.

Gregarius search.php rss_query Variable XSS

Gregarius contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'rss_query' variable upon submission to the search.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more.

Gregarius tags.php tag Variable XSS

Gregarius contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'tag' variable upon submission to the tags.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more.

Gregarius feed.php folder Variable SQL Injection

Gregarius contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the feed.php script not properly sanitizing user-supplied input to the 'folder' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more.

Gregarius search.php rss_query Variable SQL Injection

Gregarius contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the search.php script not properly sanitizing user-supplied input to the 'rss_query' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more.