PT-2014-9010

Name of the Vulnerable Software and Affected Versions Contenido versions prior to 4.9.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via the idart, lang, or idcat parameters in the cms/front content.php file when advanced mod rewrite AMR is disabled...

CVE-2014-9433: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in cms/frontcontent.php in Contenido before 4.9.6, when advanced mod rewrite AMR is disabled, allow remote attackers to inject arbitrary web script or HTML via the 1 idart, 2 lang, or 3 idcat parameter...

PT-2014-6352

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions prior to 4.0.1 HF3 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in...

CVE-2014-5216: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via 1 the location parameter in a dev.Empty action to nps/servlet/webacc, 2 the error parameter to nidp/jsp/x509err.jsp, 3 the lang...

PT-2014-8409

Name of the Vulnerable Software and Affected Versions ruby-lang ruby affected versions not specified Description The issue is related to a problem in ruby-lang ruby. No specific details about the nature of the issue or its potential impact are provided. Recommendations At the moment, there is no...

xili-language - index.php lang Parameter XSS

The xili-language WordPress plugin was affected by an index.php lang Parameter XSS security vulnerability...

CVE-2014-5112

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter...

Directory traversal

Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. dot dot in the lang parameter to 1 home/index.php, 2 asteriskinfo/asteriskinfo.php, 3 repo/repo.php, or 4 endpointcfg/endpointcfg.php in maint/modules/...

Code injection

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter...

PT-2014-6289

Name of the Vulnerable Software and Affected Versions Fonality trixbox affected versions not specified Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter in the maint/modules/home/index.php file. Recommendations At the moment...

CVE-2014-5112: Improper Control of Generation of Code

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter...

CVE-2014-5111: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. dot dot in the lang parameter to 1 home/index.php, 2 asteriskinfo/asteriskinfo.php, 3 repo/repo.php, or 4 endpointcfg/endpointcfg.php in maint/modules/...

Western Digital Arkeia Remote Code Execution (CVE-2014-2846)

A remote code execution vulnerability has been reported in WD Arkeia appliance. A remote attacker may exploit this vulnerability by uploading a malicious php file using the lang cookie in order to parse this file. Successful exploitation could result in an arbitrary code execution...

PT-2014-6288

Name of the Vulnerable Software and Affected Versions Fonality trixbox affected versions not specified Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to read arbitrary files by utilizing a .. dot dot in the lang parameter ...

Cross site scripting

Cross-site scripting XSS vulnerability in js/test.php in the Appointments Scheduler plugin 1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in cal/test.php in the ZdStatistics zdstats plugin 2.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

PT-2014-5993

Name of the Vulnerable Software and Affected Versions Appointments Scheduler plugin versions 1.5 and earlier for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the lang parameter in the...

CVE-2014-4579: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/test.php in the Appointments Scheduler plugin 1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2014-4605: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cal/test.php in the ZdStatistics zdstats plugin 2.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

PT-2014-6018

Name of the Vulnerable Software and Affected Versions ZdStatistics zdstats plugin versions 2.0.1 and earlier Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the lang parameter in the cal/test.php file. Recommendations For...