MediaWiki cross-site scripting vulnerability (CNVD-2015-05871)

MediaWiki is a free and free web-based Wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers, which can be used to deploy in-house knowledge management and content management systems. A cross-site scripting vulnerability exists in MediaWiki's thumb.php script. ...

DEBIAN-CVE-2015-6730

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

UBUNTU-CVE-2015-6730

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

CVE-2015-6730

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

CVE-2015-6730

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

CVE-2015-6730

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

PT-2015-7320

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.23.10 MediaWiki versions 1.24.x prior to 1.24.3 MediaWiki versions 1.25.x prior to 1.25.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not...

CVE-2015-6730: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

PT-2015-5364

Name of the Vulnerable Software and Affected Versions u5CMS versions prior to 3.9.4 Description The issue allows remote attackers to write to arbitrary files. This can be achieved by providing a 1 .. dot dot or 2 full pathname in the f parameter of the /u5admin/deletefile.php API endpoint...

CVE-2013-7174: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter...

PT-2014-3276

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.1.0 Description The issue allows remote attackers to read arbitrary files via a full pathname in the f parameter in the /cgi-bin/jc.cgi API endpoint. Recommendations For versions prior to 4.1.0, update to version...

PT-2012-5913

Name of the Vulnerable Software and Affected Versions ViewGit versions 0.0.6 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the f parameter. This can lead to the execution of malicious code on the victim's browser...

CVE-2012-5314: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ViewGit 0.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the f parameter...

CVE-2012-0896

Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter...

PT-2012-2930

Name of the Vulnerable Software and Affected Versions Count Per Day module versions prior to 3.1.1 for WordPress Description The issue allows remote attackers to read arbitrary files via the f parameter in the download.php file. This is due to an absolute path traversal vulnerability...

CVE-2012-0896: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter...

CVE-2011-1610: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.x before 6.15su3, 7.x before 7.15su4, 8.0 before 8.03asu2, and 8.5 before 8.51su1 allow remote attackers to execute...

PT-2011-3253

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 6.x through 6.15su2, 7.x through 7.15su3, 8.0 through 8.03asu1, and 8.5 through 8.50su0 Description The issue allows remote attackers to execute arbitrary SQL commands via the f, l, or n parameter ...

DEBIAN-CVE-2010-3906

Cross-site scripting XSS vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 f and 2 fp parameters...

CVE-2010-3906: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 f and 2 fp parameters...