PT-2014-5637 · WordPress · Participants Database

Name of the Vulnerable Software and Affected Versions: Participants Database plugin versions prior to 1.5.4.9 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the query parameter in an "output CSV" action to the "pdb-signup/" endpoint...

CVE-2013-6738: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint...

CVE-2012-6644: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 cat parameter to channels.php, 2 collections.php, 3 groups.php, or 4 videos.php; 5 query parameter to searchresult.php; or 6 type parameter to...

Cross site scripting

Cross-site scripting XSS vulnerability in the search feature in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2014-2280: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the search feature in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

Log Analyzer 3.6.0 Cross Site Scripting

Title: ====== Log Analyzer 3.6.0 - Cross Site Scripting Vulnerability Date: ===== 2012-12-20 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=792 Vendor:...

Cross site scripting

Cross-site scripting XSS vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2012-6045

Cross-site scripting XSS vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2012-6045: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in group/members.php in Mahara 1.5.x before 1.5.7 and 1.6.x before 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2012-2253

Cross-site scripting XSS vulnerability in group/members.php in Mahara 1.5.x before 1.5.7 and 1.6.x before 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2012-2253

CVE-2012-2253 is a cross-site scripting (XSS) vulnerability in Mahara, specifically in group/members.php. The flaw allows remote attackers to inject arbitrary web script or HTML via a query parameter. Affected versions are Mahara 1.5.x before 1.5.7 and 1.6.x before 1.6.2. The connected documents ...

CVE-2012-2253: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in group/members.php in Mahara 1.5.x before 1.5.7 and 1.6.x before 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

PHP 5.4.x < 5.4.3 Multiple Vulnerabilities

Binary data 6495.prm...

UBUNTU-CVE-2012-2922

The requestpath function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q parameter to index.php, which reveals the installation path in an error message...

PHP 5.4.x < 5.4.3 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.3. It is, therefore, potentially affected the following vulnerabilities : - The fix for CVE-2012-1823 does not completely correct the CGI query parameter vulnerability. Disclosure of PHP source code...

The vulnerability exists in the standalone and also in the online demonstration enviroment.

It is possible to anonymously enumerate all usernames via the script at /rest/prototype/1/search/user.json?max-results=10&query=XX. The 'query' GET parameter should contain at least two charakters. It is possible to enumerate all usernames by performing a search from 'query' value 'aa' to 'zz'...

Code injection

webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012...

CVE-2012-1795

webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012...

VulnCheck KEV: CVE-2012-1795

webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012...