CVE-2008-3874

Cross-site scripting XSS vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field aka Label == Value pairs. NOTE: some of these details are obtained from third party information...

CVE-2008-3874

CVE-2008-3874 describes a cross-site scripting (XSS) vulnerability in the Vanilla forum software. Affected product/version: Vanilla 1.1.5-rc1, 1.1.4, and earlier; vulnerable component: the file account.php . The underlying issue is an XSS flaw that allows remote authenticated users to inject arbi...

CVE-2008-3874: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field aka Label == Value pairs. NOTE: some of these details are obtained from third party information...

Directory traversal

Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 includes/eventsapplicationtop.php; 2 english/account.php, 3 french/account.php, a...

CVE-2008-3758

Multiple cross-site scripting XSS vulnerabilities in Lussumo Vanilla 1.1.4 and earlier 1 allow remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to people.php, and allow remote authenticated users to inject arbitrary web script or HTML via the 2 Account picture...

CVE-2008-3758: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Lussumo Vanilla 1.1.4 and earlier 1 allow remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to people.php, and allow remote authenticated users to inject arbitrary web script or HTML via the 2 Account picture...

CVE-2008-1224: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in account.php in BosClassifieds Classified Ads System 3.0 allows remote attackers to inject arbitrary web script or HTML via the returnTo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-5985: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 account.php, 2 moresmiles.php, or 3 recover.php; or 4 the "to" parameter to usercp.php...

CVE-2007-5062

The CVE-2007-5062 entry relates to the Flip 3.0 (and earlier) web application by Adam Scheinberg, where the vulnerable component is account.php. The underlying issue allows remote attackers to create administrative accounts via the un parameter in a register action, enabling privilege escalation ...

CVE-2007-5062: Undefined Security Weakness

account.php in Adam Scheinberg Flip 3.0 and earlier allows remote attackers to create administrative accounts via the un parameter in a register action...