440 matches found
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Diferior 8.03 allow remote attackers to inject arbitrary web script or HTML via the 1 postcontent parameter to post/edit/2/p1.html, related to views/post.php; the 2 slogan parameter to admin/site/2.html, related to views/admin.php; or the 3...
PT-2010-3305 · Cacti · Cacti
Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 0.8.7f Description: The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters to certain PHP files. The vulnerable parameters include hostname and description in host.php, as well...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in DiamondList 0.1.6, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 categorydescription parameter to user/main/updatecategory, which is not properly handled by app/views/categories/index.html.erb; an...
CVE-2009-4944: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in ATRC ACollab 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 address parameter to profile.php or the 2 description parameter to events/addevent.php. NOTE: the provenance of this information is unknown; the details ar...
CVE-2009-4458: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the 1 tech parameter to admin/admin/config.php during a trunks display action, the 2 description parameter during an Add...
FreePBX 2.5.2 - Zap Channel Addition Description Parameter Cross-Site Scripting
source: https://www.securityfocus.com/bid/37482/info FreePBX is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script...
CVE-2008-6956: Improper Control of Generation of Code
Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to inject arbitrary PHP code into an unspecified program via the description parameter, which is executed by invocation of index.php. NOTE: some of these details are obtained from...
CVE-2009-0603: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in index.php in the Link module 5.x-2.5 for Drupal 5.10 allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via the description parameter aka the Help field. NOTE: some of these details are...
CVE-2007-5949
Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...
Cross site scripting
Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...
CVE-2007-5949: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...
CVE-2007-4724: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters...
CVE-2006-4587
Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 description parameter in unspecified modules or the 2 solution parameter in the HelpDesk module...
CVE-2006-4587: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 description parameter in unspecified modules or the 2 solution parameter in the HelpDesk module...
PT-2006-4289 · Taskjitsu · Taskjitsu
Name of the Vulnerable Software and Affected Versions: Taskjitsu versions prior to 2.0.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters, including the title and description parameters when creating a task. Recommendations:...
CVE-2006-3397: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in Taskjitsu before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters, including the 1 title and 2 description parameters when creating a task...
CVE-2006-1622
CVE-2006-1622 describes a cross-site scripting (XSS) vulnerability in PHPSelect linksubmit. The issue arises from unsanitized input, allowing remote attackers to inject arbitrary script/HTML via the description parameter to linklist.php and potentially via index.php and linksubmit.php. Affected c...
CVE-2006-1622
Cross-site scripting XSS vulnerability in PHPSelect linksubmit allows remote attackers to inject arbitrary web script or HTML via 1 the description parameter to linklist.php and possibly other vectors involving 2 index.php and 3 linksubmit.php...
CVE-2006-1622: Undefined Security Weakness
Cross-site scripting XSS vulnerability in PHPSelect linksubmit allows remote attackers to inject arbitrary web script or HTML via 1 the description parameter to linklist.php and possibly other vectors involving 2 index.php and 3 linksubmit.php...
CVE-2005-4732: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in index.php in Tux Racer TuxBank 0.7x and 0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 name and 2 description parameters...