CVE-2011-5189

Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-5182

The CVE-2011-5182 entry concerns the Lanoba Social plugin for WordPress (version 1.0). A Cross-site Scripting (XSS) vulnerability is described in lanoba-social-plugin/index.php via the action parameter. The vendor disputes the issue, claiming input is sanitized and not sent to the browser. Connec...

CVE-2011-5184

HP Network Node Manager i 9.10 is affected by multiple cross-site scripting (XSS) vulnerabilities (CVE-2011-5184) triggered via various parameters (nnm/mibdiscover, nnm/protected/configurationpoll.jsp, nnm/protected/ping.jsp, nnm/protected/statuspoll.jsp, nnm/protected/traceroute.jsp, and nmm/val...

CVE-2011-5183

OrderSys 1.6.4 and earlier is affected by multiple SQL injection vulnerabilities. The root cause is unsafe handling of the where_clause parameter in ordering/interface_creator/ scripts (index.php, index_long.php, index_short.php), allowing remote attackers to inject and execute arbitrary SQL comm...

CVE-2011-5190

Social Book Facebook Clone 2010 has XSS vulnerabilities via PATH_INFO in multiple PHP scripts (signup.php, lostpass.php, login.php, index.php, help_tos.php, help_contact.php, help.php). The description states remote attackers can inject arbitrary web script or HTML, indicating an input sanitizati...

CVE-2011-5179

Cross-site scripting XSS vulnerability in skysa-official/skysa.php in Skysa App Bar Integration plugin, possibly before 1.04, for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter...

CVE-2011-5186

CVE-2011-5186 affects the jbShop plugin for e107 7. The vulnerability is a Cross-site Scripting (XSS) in jbshop.php via the item_id parameter, allowing remote attackers to inject arbitrary web script or HTML. Root cause is insufficient input sanitization on that parameter. Exploitation details ar...

CVE-2011-5177

CVE-2011-5177 affects the eSyndiCat Pro 2.3.05 web app. The vulnerability is multiple cross-site scripting (XSS) in admin/controller.php, exploitable via the following parameters: (1) id to the admins, (2) blocks, (3) articles, (4) suggest-category, or (5) sort on the search page. The root cause ...

CVE-2011-5188

Drupal: The Support Timer module (6.x-1.x) is vulnerable to Cross-Site Scripting (XSS) when used or configured with version prior to 6.x-1.4. The issue can be exploited by remote authenticated users who have the track time spent permission, through unsanitized user-supplied content. A fix is avai...

CVE-2011-5185

The CVE-2011-5185 entry describes a Cross-site Scripting (XSS) vulnerability in Online Subtitles Workshop’s video_comments.php (pre-2.0 rev 131). The root cause is unsanitized input in the comment parameter, enabling remote attackers to inject arbitrary web script or HTML. Documented impact per N...

CVE-2011-5185

Cross-site scripting XSS vulnerability in videocomments.php in Online Subtitles Workshop before 2.0 rev 131 allows remote attackers to inject arbitrary web script or HTML via the comment parameter...

CVE-2011-5180

The CVE-2011-5180 entry concerns the WordPress ZooEffect plugin (version 1.01) via an XSS in wp-1pluginjquery.php, exploitable through the page parameter. Affected component: the plugin’s PHP code handling page input; underlying impact is partial integrity exposure with no confidentiality or avai...

CVE-2011-5184

Multiple cross-site scripting XSS vulnerabilities in HP Network Node Manager i 9.10 allow remote attackers to inject arbitrary web script or HTML via the 1 node parameter to nnm/mibdiscover; 2 nodename parameter to nnm/protected/configurationpoll.jsp, 3 nnm/protected/ping.jsp, 4...

CVE-2011-5181

CVE-2011-5181 : A cross-site scripting vulnerability exists in the WordPress plugin ClickDesk Live Support – Live Chat 2.0, specifically in the clickdesk.php file where the cdwidgetid parameter is not properly sanitized. This allows remote attackers to inject arbitrary scripts/HTML into pages. Im...

Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST)

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-004 applied. This update contains multiple security-related fixes for the following components : - Apache - Data Security - DirectoryService - ImageIO - International Components for Unicode - Mail - PHP ...

Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components : - Apache - BIND - CoreText - Data Security - ImageIO - Installer - International Components for Unicode - Kernel - Mail - PHP ...

Thomson Wireless VoIP Cable Modem Auth Bypass

Exploit for hardware platform in category web applications Exploit Title: Thomson Wireless VoIP Cable Modem Auth Bypass Date: February 22, 2011 Authors: Glafkos Charalambous, George Nicolaou Product: TWG850-4 Wireless VoIP Cable Modem Software Version: ST9A.01.06 Severity: High Other...

ISC BIND RRSIG Query Denial of Service (CVE-2011-1907)

A denial of service vulnerability has been reported in ISC BIND...

CentOS 5 / 6 : libxml2 (CESA-2012:1288)

Updated libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity rating...

CVE-2011-3827

CVE-2011-3827 affects Novell GroupWise Internet Agent (GWIA) 8.0 prior to Support Pack 3. The iCalendar parsing in gwwww1.dll (NgwiCalTimeProperty::date) may read beyond the string when parsing a date-time, causing an out-of-bounds read and GWIA daemon crash (DoS) via a crafted .ics attachment. R...