PT-2012-3932

Name of the Vulnerable Software and Affected Versions Drupal RealName module versions 6.x-1.x before 6.x-1.5 Description The issue allows remote attackers to inject arbitrary web script or HTML via vectors related to 1 user names in page titles and 2 autocomplete callbacks, specifically in the...

PT-2012-3789

Name of the Vulnerable Software and Affected Versions Contact Save module versions prior to 6.x-1.5 for Drupal Description A cross-site scripting XSS issue exists, allowing remote authenticated users with the access site-wide contact form permission to inject arbitrary web script or HTML...

CVE-2012-4271

Multiple cross-site scripting XSS vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x before 2.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, 2 httpblkey, 3 httpblmaxage, 4 httpblthreat, 5...

CVE-2012-4277

Cross-site scripting XSS vulnerability in the smartyfunctionhtmloptionsoptoutput function in distribution/libs/plugins/function.htmloptions.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in eFront 3.6.11 allows remote authenticated users to inject arbitrary web script or HTML via the subject box of a message...

CVE-2012-4271

Multiple cross-site scripting XSS vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x before 2.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, 2 httpblkey, 3 httpblmaxage, 4 httpblthreat, 5...

CVE-2012-4264

Multiple cross-site scripting XSS vulnerabilities in the Better WP Security betterwpsecurity plugin before 3.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "server variables," a different vulnerability than CVE-2012-4263...

CVE-2012-4273

Cross-site scripting XSS vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter...

CVE-2012-2371

Cross-site scripting XSS vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the paginationwpfacethumb parameter...

CVE-2012-3869

Cross-site scripting XSS vulnerability in include/classes/class.rexlist.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php...

CVE-2012-4262

Multiple cross-site scripting XSS vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or HTML via the 1 namelast, 2 namefirst, 3 namemiddle, or 4 namemaiden parameter to modules/patient/mycarepid.php; 5 favorites or 6 lang parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter to index.php, 2 phase parameter to install.php, 3 tablename or 4 dbid parameter to sql.php, or 5 filename parameter to restore.php in...

CVE-2012-2326

Cross-site scripting XSS vulnerability in the Admin Control Panel ACP in MyBB aka MyBulletinBoard before 1.6.7 allows remote administrators to inject arbitrary web script or HTML via a malformed file name in an orphaned attachment...

CVE-2012-4251

Multiple cross-site scripting XSS vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter to index.php, 2 phase parameter to install.php, 3 tablename or 4 dbid parameter to sql.php, or 5 filename parameter to restore.php in...

CVE-2012-4259

Cross-site scripting XSS vulnerability in the contacts in 1 XPhone UC Web and the 2 web frontend for XPhone Virtual Directory in C4B XPhone Unified Communications UC 2011 Web 4.1.890S R1 allows remote attackers to inject arbitrary web script or HTML via the company name. NOTE: some of these detai...

CVE-2012-2326: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Admin Control Panel ACP in MyBB aka MyBulletinBoard before 1.6.7 allows remote administrators to inject arbitrary web script or HTML via a malformed file name in an orphaned attachment...

CVE-2012-3476

Multiple cross-site scripting XSS vulnerabilities in 1 application/views/admin/layout.php and 2 themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to a site name...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 a SCRIPT element, 2 a crafted Cascading Style Sheets CSS expression property, 3 a CSS expression property in the STYLE...

CVE-2012-2584

Multiple cross-site scripting XSS vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 the Cascading Style Sheets CSS expression property in conjunction with a CSS comment within the STYLE attribute of an IMG...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 the Cascading Style Sheets CSS expression property in conjunction with a CSS comment within the STYLE attribute of an IMG...