lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 1 Nov 2005 02:54:42 -0800 (PST)
From: alireza hassani <>
Subject: VUBB XSS & path disclosure Vulnerabilities

[KAPDA::#10] - VUBB XSS & path disclosure
KAPDA New advisory

Version: vubb alpha rc1
Bug: XSS & path disclosure
Exploitation: Remote with browser
VuBB is a Free PHP/MySQL forum/bulletin board system. 

A remote user can create a specially crafted URL that,
when loaded by a target user, will cause arbitrary
scripting code to be executed by the target user's
browser. The code will originate from the site running
the VUBB software and will run in the security context
of that site.
PATH Disclosure:
 A remote user can supply a specially crafted URL to
cause the system to display an error message that
discloses the installation path and other data.

Demonstration URL :

There is no vendor-supplied patch for this issue at
this time.

More Detail:
original advisory:

Credit :
Discovered & released by trueend5 (trueend5 kapda ir)
Security Science Researchers Institute Of Iran

Yahoo! FareChase: Search multiple travel sites in one click.

Powered by blists - more mailing lists