2004 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in ajax.php in Wiccle Web Builder WWB 1.00 and 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the posttext parameter in a site customsearch action to index.php. NOTE: some of these details are obtained from third party information...
CVE-2010-3208
CVE-2010-3208 is an XSS vulnerability in the Wiccle Web Builder (WWB) web application. The affected components are the PHP file path involved, specifically in the ajax.php handling for WWB versions 1.00 and 1.0.1. The root cause is a cross-site scripting flaw that allows an attacker to inject arb...
CVE-2010-3208
Cross-site scripting XSS vulnerability in ajax.php in Wiccle Web Builder WWB 1.00 and 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the posttext parameter in a site customsearch action to index.php. NOTE: some of these details are obtained from third party information...
CVE-2010-3208: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in ajax.php in Wiccle Web Builder WWB 1.00 and 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the posttext parameter in a site customsearch action to index.php. NOTE: some of these details are obtained from third party information...
Discuz7. X registration code to extract the XSS cross-site vulnerabilities-vulnerability warning-the black bar safety net
Vulnerability file: ajax.php Code reading: $message = "span id="seccodeswf".$ secchecktype.""& gt;/span". extensionloaded"ming" ? "script type="text/javascript" reload="1"\n$"seccodeswf$secchecktype". innerHTML=ACFLRunContent "width", "$seccodedatawidth", "height", "$seccodedataheight", "src",...
CVE-2010-0287: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the ACL Manager plugin plugins/acl/ajax.php in DokuWiki before 2009-12-25b allows remote attackers to list the contents of arbitrary directories via a .. dot dot in the ns parameter...
CVE-2010-0288: Undefined Security Weakness
A typo in the administrator permission check in the ACL Manager plugin plugins/acl/ajax.php in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010...
CVE-2010-0289: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in the ACL Manager plugin plugins/acl/ajax.php in DokuWiki before 2009-12-25c allow remote attackers to hijack the authentication of administrators for requests that modify access control rules, and other unspecified requests, via unknown...
CVE-2010-0614
SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the 1 question action, and possibly the 2 subpar or 3 numquest actions...
Sql injection
SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the 1 question action, and possibly the 2 subpar or 3 numquest actions...
CVE-2010-0614
CVE-2010-0614 is a SQL injection in evalSMSI 2.1.03 affecting ajax.php. The vulnerability allows remote attackers to inject SQL through the query parameter in the (1) question action and potentially (2) sub_par or (3) num_quest actions. Documents confirm the affected product/version and the input...
CVE-2010-0617
Cross-site scripting XSS vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the return parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2010-0617
CVE-2010-0617 affects evalSMSI, specifically version 2.1.03, with a cross-site scripting (XSS) flaw in ajax.php that allows injection of arbitrary script/HTML via the return parameter. The vulnerability is cited in multiple feeds (NVD entry, OpenVAS findings) and has a NVD base score of 4.3 (Medi...
CVE-2010-0606: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php...
CVE-2010-0614: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the 1 question action, and possibly the 2 subpar or 3 numquest actions...
CVE-2010-0605: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter...
CVE-2010-0617: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the return parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CORELAN-10-008 - Multiple vulnerabilities found in evalmsi 2.1.03
|------------------------------------------------------------------| | | | / / / / | | / / / / / / / / / / / | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | | http://www.corelan.be:8800 | | [email protected] | | |...
DokuWiki ajax.php cmd[del] Parameter Security Bypass
The remote web server is hosting a version of DokuWiki that is affected by a security bypass vulnerability in the 'cmddel', parameter of the 'lib/plugins/acl/ajax.php' script. An attacker, exploiting this flaw, could modify modify the ACL settings for a specified user or group. Note that this...
