PT-2015-3656 · WordPress · Wordpress Classifieds Plugin

Name of the Vulnerable Software and Affected Versions: Another WordPress Classifieds Plugin affected versions not specified Description: The issue allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI, which is a cross-site scripting XSS...

Cross site scripting

Cross-site scripting XSS vulnerability in Social Microblogging PRO 1.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI, related to the "Web Site" input in the Profile section...

CVE-2014-9444

Cross-site scripting XSS vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errorsfu-disallowed-mime-type0name parameter to the default URI...

Directory traversal

Directory traversal vulnerability in VDG Security SENSE formerly DIVA 2.3.13 allows remote attackers to read arbitrary files via a .. dot dot in the default URI to images/...

CVE-2014-8724

Cross-site scripting XSS vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATHINFO to the default URI...

Cross site scripting

Cross-site scripting XSS vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATHINFO to the default URI...

Directory traversal

Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. dot dot in the default URI...

Sql injection

SQL injection vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the inEmailAddress parameter in an UpdateClient action in the manageclients module to the default URI...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI...

CVE-2014-3920

Cross-site request forgery CSRF vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI...

Directory traversal

Directory traversal vulnerability in the FTP server in YingZhi Python Programming Language for iOS 1.9 allows remote attackers to read and possibly write arbitrary files via a .. dot dot in the default URI...

Directory traversal

Directory traversal vulnerability in MayGion IP Cameras with firmware before 2013.04.22 05.53 allows remote attackers to read arbitrary files via a .. dot dot in the default URI...

Directory traversal

Directory traversal vulnerability in the partition2 function in mochiwebutil.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1, allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the default URI...

CVE-2012-5641

Directory traversal vulnerability in the partition2 function in mochiwebutil.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1, allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the default URI...

CVE-2013-4649

Cross-site scripting XSS vulnerability in DotNetNuke DNN before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the dnnVariable parameter to the default URI...

PT-2014-2846

Name of the Vulnerable Software and Affected Versions DotNetNuke versions prior to 6.2.9 DotNetNuke versions 7.x prior to 7.1.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the dnnVariable parameter to the default URI. Recommendations...

CVE-2014-1597

SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI...

Sql injection

SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI...

CVE-2013-7191

Cross-site scripting XSS vulnerability in Tenmiles Helpdesk Pilot allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI for a ticket...

Cross site scripting

Cross-site scripting XSS vulnerability in Tenmiles Helpdesk Pilot allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI for a ticket...