CVE-2013-5955: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manage.php in the PBBooking compbbooking component 2.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the an arbitrary parameter in an edit action to administrator/index.php...

PT-2014-3007

Name of the Vulnerable Software and Affected Versions com pbbooking version 2.4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating an arbitrary parameter in an edit action to...

Joomla Multi Calendar 4.0.2 Cross Site Scripting

Hello, Multiple cross-site scripting XSS vulnerabilities in Multi calendar 4.0.2 component for Joomla! allow remote attackers to inject arbitrary web script or HTML code via 1 the calid parameter to index.php or 2 the paletteDefault parameter to index.php. File: /tmpl/layouteditevent.php Lines: 1...

CVE-2013-2085

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

CVE-2013-2044

Open redirect vulnerability in the Login Page index.php in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

CVE-2013-2047

The login page aka index.php in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password...

CVE-2013-2047: Undefined Security Weakness

The login page aka index.php in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password...

CVE-2013-2044: Improper Input Validation

Open redirect vulnerability in the Login Page index.php in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

PT-2014-2537

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.6 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect url parameter in the Login Page index.php. Recommendations For...

PT-2014-2545

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.6 Description The issue allows remote authenticated users to access arbitrary files. This is achieved by utilizing a .. dot dot in the dir parameter of the apps/files trashbin/index.php file, which enables...

CVE-2013-2085: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

ClanSphere "where"跨站脚本漏洞

ClanSphere是一个高级Web内容管理系统，主要用于搭建部落和电子竞技类网站。 由于通过"where" GET参数传递到index.php 当"mod"设置为"users"的输入在返回用户前没有正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 ClanSphere 2011.4.3 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.csphere.eu/...

CVE-2013-6037

Cross-site scripting XSS vulnerability in index.php in Aker Secure Mail Gateway 2.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the msgid parameter...

CVE-2013-6037: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Aker Secure Mail Gateway 2.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the msgid parameter...

PT-2014-3021

Name of the Vulnerable Software and Affected Versions Aker Secure Mail Gateway versions 2.5.2 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the msg id parameter in the...

PT-2014-2579

Name of the Vulnerable Software and Affected Versions Batavi version 1.2.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the QUERY STRING to "admin/index.php". This could potentially lead to unauthorized actions on the affected...

PyroCMS "email"跨站脚本漏洞

PyroCMS是一款内容管理系统。 由于传递到index.php/register中"email" POST参数的输入在返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 PyroCMS 2.2.3 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： https://www.pyrocms.com/...

storytlr "search"跨站脚本漏洞

storytlr是一款博客平台。 由于通过"search"参数传递到index.php/search/的输入在protected/application/public/controllers/SearchController.php中被返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 storytlr 1.2 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://storytlr.org/...

CVE-2014-2316

Technical details for CVE-2014-2316 are not provided in the connected documents. The initial description notes an SQL injection in the Search Everything WordPress plugin, but no further specifics (versions, root cause, exploit, or patch) are present. Monitor for updates.

CVE-2014-1944: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the text parameter to index.php/guestbook/index/newentry...