132 matches found
Elgg <= 1.7.10 - Multiple Vulnerabilities
No description provided by source. Exploit Title: Elgg 1.7.10 = Multiple Vulnerabilities Google Dork: intext:Powered by Elgg, the leading open source social networking platform Date: 2011-08-18 Author: Aung Khant YGN Ethical Hacker Group - http://yehg.net/ Software Link:...
CVE-2013-0234
Cross-site scripting XSS vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the paramstwitterusername parameter to action/widgets/save...
Cross site scripting
Cross-site scripting XSS vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the paramstwitterusername parameter to action/widgets/save...
CVE-2013-0234
CVE-2013-0234 is a cross-site scripting (XSS) vulnerability affecting the Twitter widget in Elgg prior to 1.7.17 and 1.8.x prior to 1.8.13. The issue allows remote attackers to inject arbitrary web script or HTML through the params[twitter_username] parameter to action/widgets/save. Multiple conn...
CVE-2013-0234
Cross-site scripting XSS vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the paramstwitterusername parameter to action/widgets/save...
CVE-2012-6561
Cross-site scripting XSS vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php. NOTE: some of these details are obtained from third party information...
CVE-2012-6563
engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors...
CVE-2012-6562
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts...
Cross site scripting
Cross-site scripting XSS vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php. NOTE: some of these details are obtained from third party information...
Design/Logic Flaw
engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors...
Code injection
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts...
CVE-2012-6562
CVE-2012-6562 affects Elgg prior to 1.8.5. The vulnerability stems from engine/lib/users.php not properly specifying permissions for the useradd action, allowing remote attackers to create arbitrary accounts. Impact is user creation without proper authorization. Root cause: insufficient permissio...
CVE-2012-6563
CVE-2012-6563 affects Elgg prior to 1.8.5. The issue is in engine/lib/access.php where cached access lists are not properly cleared during plugin boot, allowing remote attackers to read private entities via unspecified vectors. Impact is read access to private data; no exploit vectors are detaile...
CVE-2012-6561
CVE-2012-6561 affects Elgg prior to 1.8.5. The vulnerability exists in the engine/lib/views.php component, where the view parameter of index.php can be manipulated to inject arbitrary web script or HTML (a reflected/DOM-like XSS as described in sources). Impact is remote code execution within the...
CVE-2012-6561
Cross-site scripting XSS vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php. NOTE: some of these details are obtained from third party information...
CVE-2012-6562
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts...
CVE-2012-6563
engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors...
Cometchat Application - Multiple Vulnerabilities
Exploit for php platform in category web applications meta http-...
Cometchat Application - Multiple Vulnerabilities
Exploit-DB Note 20-02-2013: A security patch appears to have been released to address the issue: http://www.cometchat.com/blog/cometchat-critical-security-update/ Info: All Cometchat Application Multiple Vulnerabilities Cometchat is a application which can be used in many site for example phpFox,...
XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget")
Hello dear XSS bored audience, the PHP based social networking engine Elgg 1, versions 1.8.12 and 1.7.16 and earlier, bears a persistent script injection vulnerability in its core module "Twitter widget", which allows for XSS attacks. On installations which have the Twitter widget activated...