Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		19.05.2007
Source:
SecurityVulns ID:		7724
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Affected:		APACHE : Tomcat 4.0
		APACHE : Tomcat 4.1
		APACHE : Tomcat 5.0
		APACHE : Tomcat 5.5
		APACHE : Tomcat 6.0
		CANDYPRESS : CandyPress 3.5
		PARODIA : Parodia 6.4
		CLIENTEXEC : ClientExec 3.0
		TRACKPLUS : Track+ 3.3
		ACAL : ACal Web Calendar 2.2
		MADRISHWEBMAIL : Madirish Webmail 2.0
		PSYCHOSTATS : PsychoStats 3.0
CVE:		CVE-2007-1355 (Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.)

Original document		Mark Thomas, [CVE-2007-1355] Tomcat documentation XSS vulnerabilities (19.05.2007)
		mybeni websecurity, [Full-disclosure] Wordpress Akismet XSS flaw (19.05.2007)
		kefka, [Full-disclosure] PsychoStats 3.0.6b and prior (19.05.2007)
		...::BoZKuRTSeRDaR::..., ACal Web Calendar 2.2.6 Remote File Include Vulnerabilities (19.05.2007)
		...::BoZKuRTSeRDaR::..., Madirish Webmail v2.0 Remote File Include Vulnerabilities (19.05.2007)
		r0t, Track+ XSS vuln. (19.05.2007)
		r0t, ClientExec XSS vuln. (19.05.2007)
		r0t, Parodia XSS vuln (19.05.2007)
		r0t, CandyPress™ Store XSS vuln. (19.05.2007)

Discuss:

Read or add your comments to this news (0 comments)