13954 matches found
CVE-2014-3826
CVE-2014-3826 affects MyBB prior to 1.6.13. It is a Cross-site Scripting (XSS) vulnerability exploitable by remote authenticated users via the name parameter in the edit action of the config-profile_fields module. The issue enables injection of arbitrary web script or HTML and is documented acros...
CVE-2014-3827
Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...
CVE-2016-5710
NetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors...
CVE-2012-5570
The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basicwebmail" permission to read arbitrary users' email addresses...
Code injection
The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basicwebmail" permission to read arbitrary users' email addresses...
CVE-2015-3423
Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 ctrl, 2 h%2427, 3 h%2439, 4 param0, 5 param1, 6 param2, 7 param3, 8 param4, 9 filterINSERTCOUNT, 10 filterMINORFALLOUT, 11...
CVE-2015-2207
Multiple cross-site scripting XSS vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the 1 ctrl, 2 t900010theformselection, 3 scroll, 4 tableName, 5 parent, 6 circuit, 7 return, 8 xname, or 9...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the 1 ctrl, 2 t900010theformselection, 3 scroll, 4 tableName, 5 parent, 6 circuit, 7 return, 8 xname, or 9...
Sql injection
Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 ctrl, 2 h%2427, 3 h%2439, 4 param0, 5 param1, 6 param2, 7 param3, 8 param4, 9 filterINSERTCOUNT, 10 filterMINORFALLOUT, 11...
CVE-2015-2207
NetCracker Resource Management System (
CVE-2015-2207
Multiple cross-site scripting XSS vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the 1 ctrl, 2 t900010theformselection, 3 scroll, 4 tableName, 5 parent, 6 circuit, 7 return, 8 xname, or 9...
CVE-2015-3423
Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 ctrl, 2 h%2427, 3 h%2439, 4 param0, 5 param1, 6 param2, 7 param3, 8 param4, 9 filterINSERTCOUNT, 10 filterMINORFALLOUT, 11...
CVE-2014-7863
The FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to 1 read arbitrary...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 sortby, 2 sortorder, 3 itemsview, 4 dir, 5 clipboardtask, 6 clipboardfiles, 7 clipboardsrc, or 8 clipboarddes...
CVE-2015-1394
Multiple cross-site scripting XSS vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 sortby, 2 sortorder, 3 itemsview, 4 dir, 5 clipboardtask, 6 clipboardfiles, 7 clipboardsrc, or 8 clipboarddes...
CVE-2013-3638
SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL commands via the 'pathes' parameter in 'categories.php'...
Sql injection
SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL commands via the 'pathes' parameter in 'categories.php'...
CVE-2013-3638
SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL commands via the 'pathes' parameter in 'categories.php'...
CVE-2013-3638
CVE-2013-3638 describes a SQL injection in BoonEx Dolphin prior to 7.1.3. The flaw arises from insufficient validation of the pathes[] HTTP POST parameter passed to /administration/categories.php, allowing a remote authenticated user to execute arbitrary SQL commands in the database (with CSRF ri...