CVE-2012-4336: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in Flogr 2.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 an arbitrary parameter...

CVE-2012-4928: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in owupdates/index.php in Oxwall 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the plugin parameter...

PT-2012-5662

Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 1.91+ Build 120224 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the fieldnames parameter to the "index.php" endpoint. Recommendations For versions prior to...

PT-2012-5663

Name of the Vulnerable Software and Affected Versions Oxwall version 1.1.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the plugin parameter in the ow updates/index.php file...

CVE-2012-4927: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Limesurvey a.k.a PHPSurveyor before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php...

CVE-2012-1469: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the 1 editor or 2 callback parameters to lib/pkp/lib/tinymce/jscripts/tinymce/plugins/ibrowser/ibrowser.php in th...

CVE-2012-1112: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the selectuserstemplate parameter to index.php...

PT-2012-3086

Name of the Vulnerable Software and Affected Versions Open-Realty CMS versions 2.5.8 and earlier Description A directory traversal issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the select users template parameter to the...

PT-2012-3294

Name of the Vulnerable Software and Affected Versions Open Journal Systems versions prior to 2.3.7 Description The issue allows remote attackers and remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the editor or callback parameters to...

CVE-2012-4870: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 context parameter to panel/indexamp.php or 2 panel/dhtml/index.php; 3 clid or 4 clidname parameters to panel/flash/mypage.php; 5 PATHINFO to...

CVE-2012-4392

index.php in ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value...

CVE-2012-4392

index.php in ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value...

CVE-2012-4395

Cross-site scripting XSS vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirecturl parameter...

CVE-2012-4392

The vulnerability CVE-2012-4392 affects ownCloud Server versions earlier than 4.0.7, where index.php fails to properly validate the oc_token cookie, enabling remote attackers to bypass authentication with a crafted cookie. Multiple connected sources corroborate the authentication bypass issue and...

CVE-2012-4395: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirecturl parameter...

CVE-2012-4392: Improper Authentication

index.php in ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value...

PT-2012-5366

Name of the Vulnerable Software and Affected Versions ownCloud version 4.0.7 Description The issue concerns improper validation of the oc token cookie in the index.php file, allowing remote attackers to bypass authentication by crafting a specific oc token cookie value. Recommendations For ownClo...

PT-2012-5369

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.3 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the redirect url parameter in the index.php...

PT-2012-3383

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions prior to 1.5.20 Description The issue allows remote attackers to obtain sensitive information via various invalid parameters to different scripts, which reveals the installation path in an error message. This...

CVE-2012-1614: Exposure of Sensitive Information to an Unauthorized Actor

Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via 1 a direct request to plugins/visiblehookpoints/index.php, an invalid 2 page or 3 cat parameter to thumbnails.php, an invalid 4 page parameter to usermgr.php, or an invalid 5 newerthan or 6 oldertha...