Network Security News – Wednesday, March 08, 2006 Events
Lurker Unspecified XSS
Lurker contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified or unknown variables upon submission to an unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/23696
Gregarius search.php rss_query Variable XSS
Gregarius contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'rss_query' variable upon submission to the search.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/23678
Gregarius tags.php tag Variable XSS
Gregarius contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'tag' variable upon submission to the tags.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/23679
Gregarius feed.php folder Variable SQL Injection
Gregarius contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the feed.php script not properly sanitizing user-supplied input to the 'folder' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/23680
Gregarius search.php rss_query Variable SQL Injection
Gregarius contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the search.php script not properly sanitizing user-supplied input to the 'rss_query' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/23681