CVE-2014-4723: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter to wp-admin/options-general.php...

Wolfram Research webMathematica 4.0 File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5035/info Wolfram Research's webMathematica is a Java based product which allows the inclusion of Mathematica content in a web environment. It includes CGI programs which generate image content based on user supplied inpu...

CVE-2014-3808

Multiple cross-site scripting XSS vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 role parameter to roles.lsp, 2 name parameter to user.lsp, 3 path parameter to wizard/setuser.lsp, 4 host parameter to tunnelconstr.lsp, or 5...

CVE-2014-1603

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 param parameter to admin/load.php or 2 user, 3 email, or 4 name parameter in a Save Settings action to admin/settings.php...

Atmail Webmail 6.6.x < 6.6.3 / 7.x < 7.0.3 File Name Parameter XSS

According to its version, the Atmail Webmail install on the remote host is version 6.6.x prior to 6.6.3 or 7.x prior to 7.0.3. It is, therefore, potentially affected by an input validation error related to the script '/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/' and the 'File...

DEBIAN-CVE-2013-1770

Cross-site scripting XSS vulnerability in viewsview.php in Ganglia Web 3.5.7 allows remote attackers to inject arbitrary web script or HTML via the viewname parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-2670: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-0344: Undefined Security Weakness

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

php-font-lib 'name'参数跨站脚本漏洞

Bugtraq ID:66380 CVE ID:CVE-2014-2570 php-font-lib是一款读取，解析，导出不同字体类型文件的PHP库。 通过"name" GET参数传递给www/makesubset.php的输入在返回用户之前缺少过滤，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可获取敏感信息或劫持用户会话。 0 php-font-lib 0.x php-font-lib 0.3.1已经修复该漏洞，建议用户下载更新： https://github.com/PhenX/php-font-lib...

CVE-2013-5714: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 message parameter. NOTE: some of these details are...

PT-2013-5746 · Videowhisper · Videowhisper Live Streaming Integration

Name of the Vulnerable Software and Affected Versions: VideoWhisper Live Streaming Integration plugin versions 4.25.3 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML via the name or message parameter in the ls/htmlchat.php file. This can lead to...

CVE-2013-3598: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attackers to overwrite arbitrary files via a .. dot dot in the name parameter...

CVE-2013-5319: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in secure/admin/user/views/deleteuserconfirm.jsp in the Admin Panel in Atlassian JIRA before 6.0.5 allows remote attackers to inject arbitrary web script or HTML via the name parameter to secure/admin/user/DeleteUser!default.jspa...

CVE-2013-4951: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Mintboard 0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 pass parameter in views/login.php or 3 name or 4 pass parameter in views/signup.php...

CVE-2011-5203: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in WB/Default.asp in Akiva WebBoard before 8 SR 1 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information...

CVE-2012-1188: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the 1 type or 2 querystring parameters to private/en/error or 3 name parameter to private/en/locale/index...

Sql injection

Multiple SQL injection vulnerabilities in sign.php in tinyguestbook allow remote attackers to execute arbitrary SQL commands via the 1 name and 2 msg parameters. NOTE: some of these details are obtained from third party information...

CVE-2011-5201: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in sign.php in tinyguestbook allow remote attackers to execute arbitrary SQL commands via the 1 name and 2 msg parameters. NOTE: some of these details are obtained from third party information...

CVE-2012-1632: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in passwordpolicy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote authenticated users with administer policies permissions to inject arbitrary web script or HTML via the name parameter...