13677 matches found
CVE-2013-4887
SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter...
CVE-2013-4887
CVE-2013-4887 affects Digital Signage Xibo 1.4.2. The vulnerability is a SQL injection in the web interface (index.php) that can be exploited via the displayid parameter to execute arbitrary SQL commands. Documented impact indicates remote attackers may obtain partial confidentiality/integrity/av...
CVE-2013-4888
CVE-2013-4888 (Digital Signage Xibo 1.4.2) is a documented XSS in index.php via the layout parameter on the layout page; CVE-2013-4889 describes CSRF that can hijack admin actions (e.g., AddUser) and, as noted, can enable XSS through the same page. Exploitation details are present (e.g., CSRF exp...
CVE-2013-4888
Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...
CVE-2013-4889
Multiple cross-site request forgery CSRF vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new administrator via the AddUser action or 2 conduct cross-site scripting XSS attacks, as demonstrat...
CVE-2014-1683: Use of Externally-Controlled Format String
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 name, 2 email, 3 subject, or 4 message parameter to...
CVE-2013-4887: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter...
CVE-2013-4888: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...
CVE-2013-4889: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new administrator via the AddUser action or 2 conduct cross-site scripting XSS attacks, as demonstrat...
PT-2014-4291
Name of the Vulnerable Software and Affected Versions SkyBlueCanvas CMS versions prior to 1.1 r248-04 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the name, email, subject, or message parameter to "index.php" when the pid parameter is 4...
Light Weight Calendar index.php date Parameter PHP Code Execution - Ver2 (CVE-2006-0206)
A code execution vulnerability has been reported in Light Weight Calendar. The vulnerability is due to the application does not validating the 'date' variable upon submission to the 'index.php' script. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrar...
Eventum - Insecure File Permissions
source: https://www.securityfocus.com/bid/65186/info Eventum is prone to an insecure file-permission vulnerability. An attacker can exploit this issue to reinstall vulnerable application. This may aid in further attacks. Eventum 2.3.4 is vulnerable; other versions may also be affected. Following...
PT-2014-3847
Name of the Vulnerable Software and Affected Versions Joomla! component JV Comment com jvcomment versions prior to 3.0.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the id parameter in a comment.like action to index.php...
CVE-2014-0010
Multiple cross-site request forgery CSRF vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete 1...
PT-2014-3432
Name of the Vulnerable Software and Affected Versions Moodle versions 2.2.11 and earlier, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, 2.6.x before 2.6.1 Description The issue allows remote attackers to hijack the authentication of administrators for requests, specifically to dele...
CVE-2014-0010: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete 1...
CVE-2012-6631
Cross-site request forgery CSRF vulnerability in accounts/admin/index.php in Vessio NetBill 1.2 allows remote attackers to hijack the authentication of administrators for requests that add accounts via a new-client action...
PT-2014-2401
Name of the Vulnerable Software and Affected Versions Vessio NetBill version 1.2 Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This is possible via the full name or file title to accounts/admin/index.php, ...
CVE-2012-6621: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 Email Address or 2 Custom Permalink Structure fields in admin/settings.php; 3 path parameter to admin/upload.php; 4 err paramet...
CVE-2012-6632: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Vessio NetBill 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 file title to accounts/admin/index.php or 3 comment parameter in the support page to accounts/index2.php...