747 matches found
PT-2012-3005
Name of the Vulnerable Software and Affected Versions LEPTON versions prior to 1.1.4 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the message parameter to...
tomcat: XSS vulnerability in HTML Manager interface
Multiple cross-site scripting XSS vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag...
PT-2011-5122
Name of the Vulnerable Software and Affected Versions Atlassian FishEye versions prior to 2.5.5 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the user profile feature. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via two...
Sql injection
Multiple SQL injection vulnerabilities in Simple Machines Forum SMF before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a 1 HTML entity or 2 display name. NOTE: some of these details are obtained from third party information...
CVE-2011-3615
Multiple SQL injection vulnerabilities in Simple Machines Forum SMF before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a 1 HTML entity or 2 display name. NOTE: some of these details are obtained from third party information...
PT-2011-4547
Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF versions prior to 1.1.15 Simple Machines Forum SMF versions 2.x prior to 2.0.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via vectors involving a HTML entity ...
CVE-2011-3615: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Simple Machines Forum SMF before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a 1 HTML entity or 2 display name. NOTE: some of these details are obtained from third party information...
tomcat: XSS vulnerability in HTML Manager interface
Multiple cross-site scripting XSS vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag...
tomcat: XSS vulnerability in HTML Manager interface
Multiple cross-site scripting XSS vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag...
tomcat: XSS vulnerability in HTML Manager interface
Multiple cross-site scripting XSS vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag...
CVE-2011-0013
Multiple cross-site scripting XSS vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag...
CVE-2011-0013: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag...
WhiteBoard 0.1.30 Blind SQL Injection
WhiteBoard 0.1.30 Multiple Blind SQL Injection Vulnerabilities Name WhiteBoard Vendor http://sarosoftware.com Versions Affected 0.1.30 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-07-24 X. INDEX I. ABOUT THE...
Code injection
Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow 1 remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking...
CVE-2009-1677
Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow 1 remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking...
Bitweaver 2.6 - 'saveFeed()' Remote Code Execution
saveFeed $rssversionname, $cacheFile ; ... it calls saveFeed function in an insecure way, arguments are built on $REQUESTversion var and may contain directory traversal sequences... now look at saveFeed function in /rss/feedcreator.class.php ... function saveFeed$filename="", $displayContents=tru...
PT-2008-6645 · Projectpier · Projectpier
Name of the Vulnerable Software and Affected Versions: ProjectPier versions 0.8 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML via various means, including a message, a milestone, or a display name in a profile, or the a or c parameter to...
projectpier-xssxsrf.txt
====================================================================== ProjectPier Impact: Cross Site Scripting Cross Site Request Forgery Status: patch available ------------------------------ Affected software description: ------------------------------ Application: ProjectPier Version: = 0.80...
blogspot.txt
Blogspot.com Homepage: http://www.blogspot.com Affected files: Blog input boxes ------------------------------------------ XSS vuln via Display name input box. Blogger doesnt properally sanatize user input before generating it. For example, you can't use illegal characters in your username,or...