CVE-2009-2930: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Search feature in elka CMS aka Elkapax allows remote attackers to inject arbitrary web script or HTML via the q parameter to the default URI...

Elkapax CMS Cross Site Scripting

================= IUT-CERT ================= Title: Elkapax CMS Multiple Vulnerabilities Vendor: www.elkapax.com Type: Input.Validation.Vulnerability Cross Site Scripting Fix: N/A ================== nsec.ir ================= Description: ------------------ Elkapax is a CMS producer in Iran. Searc...

CVE-2008-6879

Cross-site scripting XSS vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action...

CVE-2008-6879: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action...

CVE-2009-2595: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in productSearch.html in Censura 2.0.4 and 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a ProductSearch action...

CVE-2009-2571: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in VerliAdmin 0.3.7 and 0.3.8 allow remote attackers to inject arbitrary web script or HTML via 1 the URI, 2 the q parameter, 3 the nick parameter, or 4 the nick parameter in a bantest action...

CVE-2009-2302: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. NOTE: it was later reported that 5.2.1 is also affected...

CVE-2009-2289: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Arcade Trade Script 1.0 beta allows remote attackers to inject arbitrary web script or HTML via the q parameter in a gamelist action...

Wireshark: Multiple vulnerabilities

Background Wireshark is a versatile network protocol analyzer. Description Multiple vulnerabilities have been discovered in Wireshark: David Maciejak discovered a vulnerability in packet-usb.c in the USB dissector via a malformed USB Request Block URB CVE-2008-4680. Florent Drouin and David...

Dan Geer: Risk management should change the future

By Joan Goodchild, CSO “The dean of the security deep thinkers,” “security luminary, ” and “risk-management pioneer” are all phrases that have been used to describe Dan Geer. Considered one of the foremost leaders in information security, his resume includes time as president and chief scientist ...

CVE-2008-6476: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in blog/search.aspx in BlogEngine.NET allows remote attackers to inject arbitrary web script or HTML via the q parameter...

Sql injection

SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the 1 UserID and 2 Pwd parameters. NOTE: this might be related to CVE-2004-2108...

Cross site scripting

Cross-site scripting XSS vulnerability in search.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the srkeys parameter...

CVE-2008-6258

SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the 1 UserID and 2 Pwd parameters. NOTE: this might be related to CVE-2004-2108...

CVE-2008-6258

SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the 1 UserID and 2 Pwd parameters. NOTE: this might be related to CVE-2004-2108...

CVE-2008-6259

Cross-site scripting XSS vulnerability in search.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the srkeys parameter...

CVE-2008-6258

The CVE-2008-6258 entry describes an SQL injection vulnerability in QuadComm Q-Shop 3.0 (and possibly earlier) affecting users.asp, where the (1) UserID and (2) Pwd parameters allow remote attackers to execute arbitrary SQL commands. This is a classic input-based injection affecting the web appli...

CVE-2008-6259

CVE-2008-6259 describes a cross-site scripting (XSS) vulnerability in QuadComm Q-Shop 3.0 (search.asp) that allows an attacker to inject arbitrary script/HTML via the srkeys parameter. Affected product: QuadComm Q-Shop 3.0 and possibly earlier versions. Root cause: unsafeguarded handling of the s...

CVE-2008-6259: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the srkeys parameter...

CVE-2008-6258: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the 1 UserID and 2 Pwd parameters. NOTE: this might be related to CVE-2004-2108...