Cross site scripting

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...

CVE-2015-2941

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...

CVE-2015-2941

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...

CVE-2015-2941

CVE-2015-2941 affects MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 when HHVM is used. The vulnerability arises from improper handling of a wddx_serialize_value call in api.php for invalid parameters in a wddx format request, which can lead to cross-site scripting v...

CVE-2015-2941

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...

CVE-2015-2941: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...

PT-2015-5991

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.24 MediaWiki versions 1.20.x through 1.23.9 MediaWiki versions 1.24.x through 1.24.2 Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via an...

CVE-2014-8790

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...

CVE-2014-8790: Undefined Security Weakness

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...

PT-2015-4081

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions 3.1.1 through 3.3.x Description The issue allows remote attackers to read arbitrary files via the data parameter in certain configurations. This is due to an XML external entity XXE vulnerability in the admin/api.php fil...

PT-2015-4171

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.1.0a1 through 1.2.x before 1.2.18 Description A cross-site scripting XSS issue exists in the helper api.php file when the Extended project browser is enabled. This allows remote attackers to inject arbitrary web script or...

PT-2014-8614

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.18 Description The issue allows remote attackers to obtain sensitive information. This can be achieved via specific SOAP requests, including mc project get users, mc issue get, mc filter get issues, or mc project...

PT-2014-8615

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.18 Description The issue is related to a SQL injection vulnerability in the mc project get attachments function. This vulnerability allows remote attackers to execute arbitrary SQL commands via the project id...

UC Gateway Investment SiteEngine 5.0 'api.php' URI Redirection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31888/info SiteEngine is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing-style attacks. SiteEngine 5.0 is...

PT-2014-4254

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.16 Description The issue allows remote attackers to execute arbitrary SQL commands via unspecified parameters to various functions, including mc project get attachments in api/soap/mc project api.php, news get...

PT-2014-4253

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.16 Description The issue allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a "mc issue attachment get" SOAP request. This is due to a SQL injection vulnerability in the mci...

PT-2014-4445

Name of the Vulnerable Software and Affected Versions Media File Renamer plugin version 1.7.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Media File Renamer plugin for WordPress. These vulnerabilities are found in the callback multicheck, callback radio...

CVE-2014-2244

Cross-site scripting XSS vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in t...

PT-2014-4580

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.12 MediaWiki versions 1.20.x MediaWiki versions 1.21.x prior to 1.21.6 MediaWiki versions 1.22.x prior to 1.22.3 Description A cross-site scripting XSS issue exists due to a vulnerability in the formatHTML...

CVE-2014-2244: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in t...