CVE-2007-6726

CVE-2007-6726 refers to multiple XSS vulnerabilities in Dojo 0.4.1 and 0.4.2 as used in Apache Struts and other products. The issues allow remote injection of arbitrary script/HTML via vectors involving xip_client.html and xip_server.html in src/io/. The NVD entry lists a MEDIUM severity (CVSSv2:...

CVE-2008-6681

Cross-site scripting XSS vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML via XML entities in a TEXTAREA element...

CVE-2007-6726

Multiple cross-site scripting XSS vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving 1 xipclient.html and 2 xipserver.html in src/io/...

CVE-2008-6681: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML via XML entities in a TEXTAREA element...

CVE-2007-6726: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving 1 xipclient.html and 2 xipserver.html in src/io/...

Design/Logic Flaw

The Dojo framework exchanges data using JavaScript Object Notation JSON without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other...

CVE-2007-2376

The Dojo framework exchanges data using JavaScript Object Notation JSON without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other...

CVE-2007-2376

The CVE-2007-2376 entry describes a vulnerability in the Dojo framework where data is exchanged in JSON without a protective scheme, allowing remote attackers to exfiltrate data by loading a URL in the SRC attribute of a SCRIPT element and then reading it with other JavaScript. This results in pa...

CVE-2007-2376

The Dojo framework exchanges data using JavaScript Object Notation JSON without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other...

CVE-2007-2376: Undefined Security Weakness

The Dojo framework exchanges data using JavaScript Object Notation JSON without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other...

PT-2007-3709 · Dojo Foundation · Dojo

Name of the Vulnerable Software and Affected Versions: Dojo framework affected versions not specified Description: The issue concerns the exchange of data using JavaScript Object Notation JSON without proper protection, allowing remote attackers to obtain the data. This is achieved through a web...

CVE-2006-3560

SQL injection vulnerability in topics.php in Blue Dojo Graffiti Forums 1.0 allows remote attackers to execute arbitrary SQL commands via the f parameter...

CVE-2006-3560

The CVE covers an SQL injection in topics.php of Blue Dojo Graffiti Forums 1.0, exploitable via the f parameter to execute arbitrary SQL commands remotely. This affects the application’s database interactions (vulnerability in a PHP script), with potential impacts to confidentiality, integrity, a...

CVE-2006-3560

SQL injection vulnerability in topics.php in Blue Dojo Graffiti Forums 1.0 allows remote attackers to execute arbitrary SQL commands via the f parameter...

CVE-2006-3560: Undefined Security Weakness

SQL injection vulnerability in topics.php in Blue Dojo Graffiti Forums 1.0 allows remote attackers to execute arbitrary SQL commands via the f parameter...