SITA Software Azur CMS 跨站脚本漏洞

SITA Software Azur CMS is a web CMS. A cross-site scripting vulnerability exists in SITA Software Azur CMS 1.2.3.1 and prior versions, which stems from the software's lack of effective validation and filtering of parameters. This allows a remote attacker to pass 1 NOMCLI, 2 ADRESSE, 3 ADRESSE2, 4...

CVE-2016-1915

Multiple cross-site scripting XSS vulnerabilities in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to 1 mydevice/index.jsp or 2 mydevice/loggedOut.jsp...

CVE-2016-1915

Multiple cross-site scripting XSS vulnerabilities in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to 1 mydevice/index.jsp or 2 mydevice/loggedOut.jsp...

CVE-2016-1915: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to 1 mydevice/index.jsp or 2 mydevice/loggedOut.jsp...

HotelCMS with Booking Engine - SQL injection vulnerability

http://localhost/PATH/locale? locale=SQL the locale parameter there is sql injection Wherein the error injection as follows: payload: http://localhost/PATH/locale? locale=1' AND SELECT 3507 FROMSELECT COUNT,CONCATFLOORRAND02,md5233x FROM INFORMATIONSCHEMA. The PLUGINS GROUP BY xa-- Lilt Test...

BlackBerry Enterprise Service Cross-Site Scripting Vulnerability (CNVD-2016-02632)

BlackBerry Enterprise Service BES is a next-generation mobile device management platform from BlackBerry Canada. A cross-site scripting vulnerability exists in the index.jsp/loggedOut.jsp file in BES version 12.3.1, which can be exploited by a remote attacker to affect confidentiality, integrity...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 Locale or 2 FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm...

global.puma.com XSS vulnerability

Vulnerable URL: http://global.puma.com/en/home?locale='"...

CVE-2014-0331: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the locale parameter to guipartA/...

PT-2014-3564

Name of the Vulnerable Software and Affected Versions FortiADC versions prior to 3.2.1 Description A cross-site scripting XSS issue exists in the web administration interface, allowing remote attackers to inject arbitrary web script or HTML via the locale parameter to the "gui partA/" endpoint...

VulnCheck KEV: CVE-2017-16959

The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP heade...

Sql injection

SQL injection vulnerability in the augmentSQL method in core/model/Translatable.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when the Translatable extension is enabled, allows remote attackers to execute arbitrary SQL commands via the locale parameter...

CVE-2010-4824

SQL injection vulnerability in the augmentSQL method in core/model/Translatable.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when the Translatable extension is enabled, allows remote attackers to execute arbitrary SQL commands via the locale parameter...

PT-2012-1315

Name of the Vulnerable Software and Affected Versions SilverStripe versions 2.3.x through 2.3.9 SilverStripe versions 2.4.x through 2.4.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through the locale parameter when the Translatable extension ...

CVE-2010-4824: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the augmentSQL method in core/model/Translatable.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when the Translatable extension is enabled, allows remote attackers to execute arbitrary SQL commands via the locale parameter...

Adobe ColdFusion 'locale' Parameter Directory Traversal

The version of Adobe ColdFusion running on the remote host is affected by a directory traversal vulnerability in the administrative web interface. Input to the 'locale' parameter of multiple pages is not properly sanitized. A remote, unauthenticated attacker can exploit this by sending specially...

PT-2010-1184

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 9.0.1 and earlier Description The issue allows remote attackers to read arbitrary files due to directory traversal vulnerabilities in the administrator console. This is achieved via the locale parameter to various...

CVE-2010-2861

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to 1 CFIDE/administrator/settings/mappings.cfm, 2 logging/settings.cfm, 3 datasources/index.cfm, 4...

CVE-2010-2861: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to 1 CFIDE/administrator/settings/mappings.cfm, 2 logging/settings.cfm, 3 datasources/index.cfm, 4...

CVE-2008-2227: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in PHP-Fusion Forum Rank System 6 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the settingslocale parameter to 1 forum.php and 2 profile.php in infusions/ranksystem/. NOTE: the provenance of this information i...