CVE-2012-4998

Cross-site scripting XSS vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2012-4998

Cross-site scripting XSS vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2012-4998: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2011-5176: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in search.php in Banana Dance, possibly B.1.5 and earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 category parameter...

PT-2012-2153 · Unknown · Banana Dance

Name of the Vulnerable Software and Affected Versions: Banana Dance versions prior to B.1.5 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the q or category parameters in th...

CVE-2012-2069: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Wishlist module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.6 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting XSS sequences via the 1 wlreveal or 2 q parameter...

CVE-2012-2064: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in theme/viewslangswitch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2012-2064

Cross-site scripting XSS vulnerability in theme/viewslangswitch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2012-2083: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the fusioncorepreprocesspage function in fusioncore/template.php in the Fusion module before 6.x-1.13 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter...

CVE-2012-2962: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer aka Dell SonicWALL Scrutinizer before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter...

CVE-2012-3391

mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote authenticated users to bypass intended access restrictions by leveraging the student role and reading the RSS feed for a...

Dell SonicWALL Scrutinizer 9.0.1 (statusFilter.php q parameter) SQL Injection

Exploit for php platform in category web applications !/usr/bin/python Exploit Title: Dell SonicWALL Scrutinizer 9.0.1 statusFilter.php q parameter SQL Injection Date: Jul 22 2012 Author: muts Version: SonicWALL Scrutinizer 9.0.1 Vendor URL: http://www.sonicwall.com Special thanks to: Tal Zeltzer...

CVE-2010-2021

Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, when non-clean to clean is enabled, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter...

CVE-2010-2021: Improper Input Validation

Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, when non-clean to clean is enabled, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter...

PT-2012-4368

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.15 Description The issue allows remote attackers to obtain sensitive information via the q parameter to "index.php", which reveals the installation path in an error message. This occurs due to a problem in the reques...

Facebook Open to Comments on Proposed Privacy Policy Changes

Facebook today announced proposed changes to its privacy policy that may better explain how it uses cookies and how long it retains your data, which is: “as long as necessary.” In addition, it wants the option to use your data for advertising on third-party Web sites. In a message called “Enhanci...

CVE-2012-1029: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in mobile/search/index.php in Tube Ace Adult PHP Tube Script 1.6 allows remote attackers to execute arbitrary SQL commands via the q parameter. NOTE: some of these details are obtained from third party information...

Update: Verisign Admits To Security Breaches in 2010

Verisign, the Internet security company responsible for management of the .COM domain, told federal regulators that it was the victim of several successful attacks in 2010, but that those incidents were not reported to the company’s management until September, 2011. The news was first reported by...

CVE-2011-3835

Multiple cross-site scripting XSS vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to 1 admin/login.php and 2 admin/404.php; the 3 q parameter to search.php; the 4 themename parameter to themesettings.php, 5 extensionname parameter ...

Cross site scripting

Cross-site scripting XSS vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82, 1.4.1, and probably other versions before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this was originally reported as a file disclosure...