PT-2017-8626

Name of the Vulnerable Software and Affected Versions Cloudera HUE versions 3.9.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the First name or Last name field in the HUE Users page, potentially leading to cross-site scripting XSS attacks...

CVE-2016-4946: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...

CVE-2016-3670

Cross-site scripting XSS vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field...

CVE-2016-1596

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

CubeCart Stored Cross-Site Scripting Vulnerability

CubeCart is an open source PHP e-commerce software system. A stored cross-site scripting vulnerability exists in CubeCart. Due to insufficient filtering of user-supplied data via the "firstname" and "lastname" HTTP POST parameters passed to the "/index.php" script input, a remotely-authenticated...

CubeCart 6.0.10 - Multiple Vulnerabilities

CubeCart 6.0.10 - Multiple Vulnerabilities Advisory ID: HTB23298 Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

PT-2015-3653

Name of the Vulnerable Software and Affected Versions Stark CRM version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including first name, last name, notes, insu name, price, and status. This can be achieved by accessing certain...

CVE-2013-4753

CVE-2013-4753 affects Claroline 1.11.9 and earlier. The vulnerability is multiple XSS flaws triggered by user input in three fields: (1) Search in inbox (messaging/messagebox.php), (2) First name in auth/profile.php, (3) Speakers in rqAdd action (calendar/agenda.php). The root cause is improper h...

PT-2014-5651

Name of the Vulnerable Software and Affected Versions TomatoCart version 1.1.8.6.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands via the First Name and Last Name fields in a new address book contact. This can be achieved by injecting malicious SQL code...

CVE-2014-3978: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands via the First Name and Last Name fields in a new address book contact...

PT-2014-6474

Name of the Vulnerable Software and Affected Versions Fat Free CRM versions prior to 0.13.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via the username, first name, or last name in a create or edit user action. This is due to multiple cross-site scripting...

CiviCRM 3.1 < Beta 5 Multiple XSS Vulnerabilities

No description provided by source. Author: h00die [email protected] & Ch3nz [email protected] Software Link: http://sourceforge.net/projects/civicrm/files/civicrm-latest/3.1.beta1/civicrm-3.1.beta1-standalone.tar.gz/download Version: 3.1 Beta 5, Tested on 3.1 Beta 1 Tested on: BT4 pre-final Greetz ...

CVE-2013-7289

Multiple cross-site scripting XSS vulnerabilities in register.php in Andy's PHP Knowledgebase Aphpkb before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the 1 firstname, 2 lastname, 3 email, or 4 username parameter...

CVE-2013-7289

Multiple cross-site scripting XSS vulnerabilities in register.php in Andy's PHP Knowledgebase Aphpkb before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the 1 firstname, 2 lastname, 3 email, or 4 username parameter...

PT-2014-3335

Name of the Vulnerable Software and Affected Versions Aphpkb versions prior to 0.95.8 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters. The vulnerable parameters include first name, last name, email, and username. Recommendations For...

CVE-2012-4848: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in IBM Lotus Foundations Start before 1.2.2c allow remote authenticated users to inject arbitrary web script or HTML via a Webconfig Users user-attribute field, as demonstrated by the 1 First Name or 2 Last Name field...

PT-2012-5608

Name of the Vulnerable Software and Affected Versions IBM Lotus Foundations Start versions prior to 1.2.2c Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a Webconfig Users user-attribute field. This can be achieved by manipulating fields such as...