OXID eShop 'index.php'多个HTTP应答拆分漏洞

Bugtraq ID:66371 CVE ID:CVE-2014-2017 OXID eShop又名OXID eSales是一个e-commerce系统,采用PHP开发,使用MySQL来存储数据。 通过"anid", "cnid"和"listtype"参数传递给index.php的输入在用于限制HTTP头字段时缺少过滤，允许远程攻击者利用漏洞把包含任意HTTP头的应答发送给用户。 0 OXID eShop 4.x OXID eShop 5.x OXID eShop Professional, Community或Enterprise version 4.7.11/5.0.11 and...

CVE-2013-5953

Multiple cross-site scripting XSS vulnerabilities in tmpl/layouteditevent.php in the Multi Calendar commulticalendar component 4.0.2, and possibly 4.8.5 and earlier, for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 calid or 2 paletteDefault parameter in an...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in tmpl/layouteditevent.php in the Multi Calendar commulticalendar component 4.0.2, and possibly 4.8.5 and earlier, for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 calid or 2 paletteDefault parameter in an...

Joomla Multi Calendar 4.0.2 Cross Site Scripting

Hello, Multiple cross-site scripting XSS vulnerabilities in Multi calendar 4.0.2 component for Joomla! allow remote attackers to inject arbitrary web script or HTML code via 1 the calid parameter to index.php or 2 the paletteDefault parameter to index.php. File: /tmpl/layouteditevent.php Lines: 1...

ClanSphere "where"跨站脚本漏洞

ClanSphere是一个高级Web内容管理系统，主要用于搭建部落和电子竞技类网站。 由于通过"where" GET参数传递到index.php 当"mod"设置为"users"的输入在返回用户前没有正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 ClanSphere 2011.4.3 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.csphere.eu/...

CVE-2013-6037

Cross-site scripting XSS vulnerability in index.php in Aker Secure Mail Gateway 2.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the msgid parameter...

storytlr "search"跨站脚本漏洞

storytlr是一款博客平台。 由于通过"search"参数传递到index.php/search/的输入在protected/application/public/controllers/SearchController.php中被返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 storytlr 1.2 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://storytlr.org/...

PyroCMS "email"跨站脚本漏洞

PyroCMS是一款内容管理系统。 由于传递到index.php/register中"email" POST参数的输入在返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 PyroCMS 2.2.3 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： https://www.pyrocms.com/...

CVE-2014-2316

Technical details for CVE-2014-2316 are not provided in the connected documents. The initial description notes an SQL injection in the Search Everything WordPress plugin, but no further specifics (versions, root cause, exploit, or patch) are present. Monitor for updates.

Aker Secure Mail Gateway reflected XSS vulnerability

Overview Aker Secure Mail Gateway 2.5.2 and previous versions contain a reflected cross-site scripting vulnerability. CWE-79 Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2013-6037Aker Secure Mail Gateway 2.5.2 and previous versions...

Sql injection

SQL injection vulnerability in Apptha WordPress Video Gallery 2.0, 1.6, and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the playid parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the login page in Open Web Analytics OWA before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owauserid parameter to index.php...

couponPHP CMS 1.0 Multiple Stored XSS and SQL Injection Vulnerabilities

Summary couponPHP is a revolutionary content management system for running Coupon and Deal websites. It is feature rich, powerful, beautifully designed and fully automatic. Description couponPHP is vulnerable to multiple Stored XSS and SQL Injection issues. Input passed via the parameters...

Joomla! Wire Immogest组件'index.php' SQL注入漏洞

Bugtraq ID:65606 Joomla!是一套在国外相当知名的内容管理系统。 Joomla! Wire Immogest组件'index.php'不正确过滤用户提交给'id'参数的数据，允许远程攻击者利用漏洞提交特制的SQL查询，可操作或者获取数据库数据。 0 Joomla! Wire Immogest 目前没有详细解决方案提供： http://www.joomla.org/...

ShopNc 6.0 /index.php SQL注入漏洞

No description provided by source...

Joomla! ‘index.php’ SQL注入漏洞

BUGTRAQ ID: 65410 Joomla!是美国Open Source Matters团队开发的一套开源的内容管理系统CMS。该系统提供RSS馈送、网站搜索等功能。 Joomla!中存在SQL注入漏洞，该漏洞源于程序使用SQL查询语句之前没有充分过滤用户提交的输入。攻击者可利用该漏洞控制应用程序，访问或修改数据，或利用底层数据库中潜在的漏洞。Joomla! 3.2.1版本中存在漏洞，其他版本也可能受到影响。 0 Joomla! 3.2.1 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.joomla.org/...

Joomla Wire Immogest SQL Injection

IIIIIIII RRRRRRRRRRRR HHHHHHHH HHHHHHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIII RRRRRRRRRR HHHHHHHHHHHHHHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIIIIIII RRRRRRRR RRRRRR...

CVE-2013-2585

Cross-site scripting XSS vulnerability in Atmail Webmail Server 6.6.x before 6.6.3 and 7.0.x before 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId//filenameOriginal/...

CVE-2014-1401

Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 search parameter to mod/content/content.php or 2 CLIENTIP, 3 XFORWARDEDFOR, 4 XFORWARDED, 5 FORWARDEDFOR, or 6 FORWARDED HTTP header to index.php...

Iconify SkyBlueCanvas‘index.php’远程命令注入漏洞

Bugtraq ID:65129 CVE:CVE-2014-1683 SkyBlueCanvas是Iconify公司的一套轻量级Web内容管理系统。该系统使用XML存储数据，并提供主题、附加组件、问题报告等功能。 Iconify SkyBlueCanvas中存在远程命令注入漏洞。攻击者可利用该漏洞在受影响应用程序上下文中执行任意命令，有助于发起进一步攻击。SkyBlueCanvas 1.1 r248-03版本中存在漏洞，其他版本也可能受到影响。 0 SkyBlueCanvas 1.1 r248-03 厂商补丁： Iconify -----...