CVE-2011-5318

CVE-2011-5318 affects diafan.CMS prior to 5.1, with multiple CSRF flaws that could hijack administrator sessions for POSTs to admin/news/saveNEWS_ID/, admin/site/save2/, or admin/usersite/save2/. The connected Red Hat and NVD entries confirm the same description. Root cause: cross-site request fo...

CVE-2011-5310

Wikipad 1.6.0 is affected by a directory traversal in pages.php that lets remote attackers read arbitrary files via a .. in the id parameter. The root cause is improper path handling in the PHP script, enabling access to filesystem locations outside the intended directory. Publicly provided refer...

CVE-2011-5299

poMMo Aardvark PR16.1 is affected by multiple cross-site scripting (XSS) vulnerabilities allowing remote attackers to inject arbitrary web script or HTML via four parameters: referer (index.php), site_name (admin/setup/config/general.php), group_name (admin/subscribers/subscribers_groups.php), an...

CVE-2011-5302

PHPDug 2.0.0 is affected by CVE-2011-5302, a CSRF flaw in adm/admin_edit.php that can allow an attacker to hijack administrator sessions and modify credentials. Root cause is a Cross-site request forgery vulnerability in the admin_edit.php endpoint. Multiple sources document the affected componen...

CVE-2011-5312

CVE-2011-5312 describes multiple cross-site scripting (XSS) vulnerabilities in Gollos 2.8, allowing remote attackers to inject arbitrary scripts via the returnurl parameter on register.aspx, publication/info.aspx, or user/add.aspx, and via the q parameter on product/list.aspx. The affected pages ...

CVE-2011-5305

CVE-2011-5305 affects CosmoShop ePRO 10.05.00 with multiple XSS vulnerabilities. The issue arises from unsanitized inputs in: (1) rcopy to cgi-bin/admin/rubrikadmin.cgi, (2) typ to cgi-bin/admin/artikeladmin.cgi, and (3) suchbegriff to cgi-bin/admin/shophilfe_suche.cgi. Remote attackers can injec...

CVE-2011-5310

Directory traversal vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to read arbitrary files via a .. dot dot in the id parameter...

CVE-2011-5300

CVE-2011-5300 affects poMMo Aardvark PR16.1. a CSRF in admin/setup/config/users.php allows remote attackers to hijack administrator authentication by submitting requests that modify credentials via certain admin_ parameters. Root cause is a CSRF in the credential-modification flow. Impact describ...

CVE-2011-5301

PHPDug 2.0.0 is affected by multiple cross-site scripting (XSS) vulnerabilities. The CVE-2011-5301 entry describes that remote attackers can inject arbitrary script/HTML via (1) story_url in add_story.php, (2) email in editprofile.php, (3) title in adm/content_add.php, or (4) username in adm/admi...

CVE-2011-5304

The CVE-2011-5304 issue involves the WordPress Sodahead Polls plugin before version 2.0.4, where multiple XSS vulnerabilities allow remote injection via poll_id in customizer.php or via customize in poll.php. The root cause is input handling flaws leading to script/HTML injection; impact is typic...

CVE-2011-5308

CVE-2011-5308 affects the WordPress plugin cdnvote where the vulnerable file is cdnvote-post.php . The root cause is multiple SQL injection flaws that allow remote attackers to manipulate the database via the parameters cdnvote_post_id or cdnvote_point , in plugin versions before 0.4.2. This coul...

CVE-2011-5294

The CVE-2011-5294 issue affects Kofax e-Transactions Sender Sendbox 2.5.0.933, specifically the LEADeMail.LEADSmtp.20 ActiveX control (LTCML14n.dll 14.0.0.34). The SaveMessage method allows remote attackers to write to arbitrary files via a pathname supplied as the first argument. Multiple connec...

CVE-2011-5314

CVE-2011-5314 affects Redaxscript 0.3.2. The vulnerability is in templates/default/index.php, where a direct request can disclose sensitive information by revealing the full server path in an error message, constituting an information disclosure (partial confidentiality impact). Connected sources...

CVE-2011-5302

Cross-site request forgery CSRF vulnerability in adm/adminedit.php in PHPDug 2.0.0 allows remote attackers to hijack the authentication of administrators for requests that modify credentials...

CVE-2011-5316

Cross-site request forgery CSRF vulnerability in admin/index.php in Cambio 0.5a nightly r37 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5295

Affected product: Gogago YouTube Video Converter, version 1.1.6. The issue is a buffer overflow in the MDIEEx.dll ActiveX control’s Download method, allowing remote code execution via a long argument. This vulnerability is reported consistently across multiple sources (NVD, Red Hat, CNVD, CVE lis...

CVE-2011-5306

CVE-2011-5306 describes a Cross-Site Request Forgery (CSRF) vulnerability in CosmoShop ePRO 10.05.00. The flaw affects the CGI component cgi-bin/admin/setup_edit.cgi and enables remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action. T...

CVE-2011-5298

Argyle Social (CVE-2011-5298) is affected by multiple CSRF vulnerabilities. The issues allow remote attackers to hijack administrator sessions for requests that (1) modify credentials via the role parameter to users/create/, (2) modify rules via the terms field in stream_filter_rule JSON data to ...

CVE-2011-5297

TTChat 1.0.4 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via (1) the msg parameter to default.php and (2) the username parameter to chat_form.php. The connected sources confirm these particular vectors but d...

CVE-2011-5303

CVE-2011-5303 affects Spitfire CMS 1.0.436 with a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the cms_username cookie. Root cause: XSS in handling the cms_username parameter. The connected records corroborate the vulnerability across mul...