Lucene search
CVE-2012-2399
Cross-site scripting vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, allowing remote attackers to inject arbitrary web script or HTML via the buttonText parameter
Show more
| Reporter | Title | Published | Views | Family All 63 |
|---|---|---|---|---|
 | CVE-2012-2399 | 21 Apr 201223:00 | – | cvelist |
| CVE-2012-3414 | 19 Jul 201310:00 | – | cvelist |
 | Cross site scripting | 21 Apr 201223:55 | – | prion |
| Cross site scripting | 19 Jul 201314:36 | – | prion |
| Design/Logic Flaw | 30 Jun 202213:15 | – | prion |
| Design/Logic Flaw | 27 Apr 201404:32 | – | prion |
 | WordPress E-Commerce 3.8.9.5 File Upload / XSS / CSRF / Code Execution | 24 Jan 201400:00 | – | packetstorm |
| WordPress 3.3.1 swfupload.swf Cross Site Scripting | 9 Nov 201200:00 | – | packetstorm |
| SWF Upload Cross Site Scripting | 13 Nov 201200:00 | – | packetstorm |
| Dotclear 2.4.4 Cross Site Scripting / Content Spoofing | 13 Apr 201300:00 | – | packetstorm |
10
Node
OROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROR
10
| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| image | binary | /wp-e-commerce/wpsc-admin/includes/save-data.functions.php | File upload vulnerability that allows remote attackers to upload arbitrary files. | CWE-616, CWE-434 |
| wpsc_action | query param | /wp-e-commerce/wpsc-admin/ajax.php | Remote code execution vulnerability due to improper handling of user input. | CWE-94 |
| c | query param | /wp-e-commerce/wpsc-admin/display-sales-logs.php | Remote code execution vulnerability due to improper handling of user input. | CWE-94 |
| image_name | query param | /wp-e-commerce/wpsc-includes/misc.functions.php | Local File Inclusion vulnerability allowing attackers to include arbitrary files. | CWE-98 |
| movieName | query param | /wp-e-commerce/wpsc-core/js/swfupload/swfupload.swf | Cross-Site Scripting (XSS) vulnerability allowing injection of arbitrary JavaScript. | CWE-352 |
| buttonImageURL | query param | /wp-e-commerce/wpsc-core/js/swfupload/swfupload.swf | Cross-Site Scripting (XSS) vulnerability allowing injection of arbitrary JavaScript. | CWE-352 |
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo21 Apr 2012 23:55Current
5.4Medium risk
Vulners AI Score5.4
CVSS210
EPSS0.01243