CVE-2013-0234

Cross-site scripting XSS vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the paramstwitterusername parameter to action/widgets/save...

Cross site scripting

Cross-site scripting XSS vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the paramstwitterusername parameter to action/widgets/save...

CVE-2013-0234

Cross-site scripting XSS vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the paramstwitterusername parameter to action/widgets/save...

CVE-2013-0234

CVE-2013-0234 is a cross-site scripting (XSS) vulnerability affecting the Twitter widget in Elgg prior to 1.7.17 and 1.8.x prior to 1.8.13. The issue allows remote attackers to inject arbitrary web script or HTML through the params[twitter_username] parameter to action/widgets/save. Multiple conn...

CVE-2012-6561

Cross-site scripting XSS vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php. NOTE: some of these details are obtained from third party information...

CVE-2012-6562

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts...

CVE-2012-6563

engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors...

Code injection

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts...

Cross site scripting

Cross-site scripting XSS vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php. NOTE: some of these details are obtained from third party information...

Design/Logic Flaw

engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors...

CVE-2012-6561

Cross-site scripting XSS vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php. NOTE: some of these details are obtained from third party information...

CVE-2012-6562

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts...

CVE-2012-6563

engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors...

CVE-2012-6561

CVE-2012-6561 affects Elgg prior to 1.8.5. The vulnerability exists in the engine/lib/views.php component, where the view parameter of index.php can be manipulated to inject arbitrary web script or HTML (a reflected/DOM-like XSS as described in sources). Impact is remote code execution within the...

CVE-2012-6563

CVE-2012-6563 affects Elgg prior to 1.8.5. The issue is in engine/lib/access.php where cached access lists are not properly cleared during plugin boot, allowing remote attackers to read private entities via unspecified vectors. Impact is read access to private data; no exploit vectors are detaile...

CVE-2012-6562

CVE-2012-6562 affects Elgg prior to 1.8.5. The vulnerability stems from engine/lib/users.php not properly specifying permissions for the useradd action, allowing remote attackers to create arbitrary accounts. Impact is user creation without proper authorization. Root cause: insufficient permissio...

Cometchat Application - Multiple Vulnerabilities

Exploit for php platform in category web applications meta http-...

Cometchat Application - Multiple Vulnerabilities

Exploit-DB Note 20-02-2013: A security patch appears to have been released to address the issue: http://www.cometchat.com/blog/cometchat-critical-security-update/ Info: All Cometchat Application Multiple Vulnerabilities Cometchat is a application which can be used in many site for example phpFox,...

XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget")

Hello dear XSS bored audience, the PHP based social networking engine Elgg 1, versions 1.8.12 and 1.7.16 and earlier, bears a persistent script injection vulnerability in its core module "Twitter widget", which allows for XSS attacks. On installations which have the Twitter widget activated...

Elgg index.php view Parameter XSS

The version of the Elgg installed on the remote host is affected by a cross-site scripting vulnerability because it fails to properly sanitize user input to the 'view' parameter of the 'index.php' script. An attacker may be able to leverage this to inject arbitrary HTML and script code into a...