CVE-2011-5220: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in templates/default/Admin/Login.html in PHP-SCMS 1.6.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter to index.php...

PT-2012-5968

Name of the Vulnerable Software and Affected Versions phpPaleo version 4.8b180 Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the phppaleo4 lang cookie. Recommendations For phpPaleo...

CVE-2012-1671: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

PT-2012-3431

Name of the Vulnerable Software and Affected Versions phpPaleo versions 4.8b155 and earlier Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter of the index.php file. This is a directory traversal vulnerability...

PT-2012-3778

Name of the Vulnerable Software and Affected Versions Views Language Switcher module version 7.x-1.1 and earlier Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the q parameter in the theme/views lang...

CVE-2011-4950

Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2011-4950: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

PT-2012-2016

Name of the Vulnerable Software and Affected Versions EGroupware Enterprise Line versions prior to 11.1.20110804-1 EGroupware Community Edition versions prior to 1.8.001.20110805 Description The issue allows remote attackers to inject arbitrary web script or HTML via the lang parameter in the...

PT-2012-3893

Name of the Vulnerable Software and Affected Versions PluXml versions prior to 5.1.6 Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting a directory traversal vulnerability in the update/index.php file. The vulnerability can b...

CVE-2012-4261: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/patient/mycare2xpatinfo.php in myCare2x allows remote attackers to execute arbitrary SQL commands via the lang parameter...

PT-2012-5289

Name of the Vulnerable Software and Affected Versions myCare2x affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the lang parameter in the modules/patient/mycare2x pat info.php module. Recommendations At the momen...

Gentoo Security Advisory GLSA 201206-13 (mono mono-debugger)

The remote host is missing updates announced in advisory GLSA 201206-13. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Scientific Linux Security Update : rgmanager on SL4.x i386/x86_64

Multiple insecure temporary file use flaws were discovered in rgmanager and various resource scripts run by rgmanager. A local attacker could use these flaws to overwrite an arbitrary file writable by the rgmanager process i.e. user root with the output of rgmanager or a resource agent via a...

CVE-2012-4031

Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attackers to read arbitrary files via a .. dot dot in the 1 lang or 2 langid cookie to port 85...

Directory traversal

Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attackers to read arbitrary files via a .. dot dot in the 1 lang or 2 langid cookie to port 85...

PT-2012-5156

Name of the Vulnerable Software and Affected Versions Wangkongbao CNS-1000 and 1100 Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to read arbitrary files. The attack can be performed by including a .. dot dot in the lang ...

PT-2012-5125

Name of the Vulnerable Software and Affected Versions Sticky Notes versions prior to 0.2.27052012.5 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the paste user or paste lang parameter to "list.php" or "show.php" API endpoints...

CVE-2011-4307

Cross-site scripting XSS vulnerability in mod/wiki/lang/en/wiki.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the section parameter...

WANGKONGBAO CNS-1000 UTM IPS-FW - Directory Traversal (Metasploit)

Exploit Title: WANGKONGBAO CNS-1000 and 1100 Network Security Platform UTM Directory Traversal Date: 7/2/2012 Exploit Author: Dillon Beresford Vendor Homepage: http://www.wangkongbao.com/products.html Version: CNS-1000 and 1100 The issue is in the /src/acloglogin.php langid and lang parameters...

SA-CONTRIB-2012-094 - Maestro module - Cross Site Request Forgery (CSRF), Cross Site Scripting (XSS)

The Maestro module is a workflow engine/solution that facilitates simple and complex business process automation. The module doesn't sufficiently filter user-supplied data in its admin screens leading to a Cross Site Scripting XSS vulnerability. A Cross Site Request Forgery vulnerability in the...