35837 matches found
CVE-2015-2198
Multiple cross-site scripting XSS vulnerabilities in editprefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the 1 homepageurl, 2 picurl, or 3 avatarurl parameter, which are not properly handled in an error message...
CVE-2015-9435
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...
CVE-2015-7234
The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors...
CVE-2015-6511
Cross-site scripting XSS vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server parameter to servicesntpd.php...
CVE-2015-6253
edx-platform before 2015-08-17 allows XSS in the Studio listing of courses...
CVE-2015-7303
Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header...
CVE-2015-1577
Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to arbitrary files via a 1 .. dot dot or 2 full pathname in the f parameter...
CVE-2015-1564
Cross-site scripting XSS vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field...
CVE-2015-2230
Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console...
CVE-2015-5455
Cross-site scripting XSS vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/...
CVE-2015-4719
The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request...
CVE-2015-8095
The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern...
CVE-2015-9445
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegalleryajaxaction operation...
CVE-2015-6960
edx-platform before 2015-09-17 allows XSS via a team name...
CVE-2015-9297
The events-manager plugin before 5.6 for WordPress has XSS...
CVE-2015-1582
Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...
CVE-2015-7838
ProcessFileUpload.jsp in SolarWinds Storage Manager before 6.2 allows remote attackers to upload and execute arbitrary files via unspecified vectors...
CVE-2015-9517
The Easy Digital Downloads EDD Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...
CVE-2015-6808
Cross-site scripting XSS vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title...