Cross site scripting

Cross-site scripting XSS vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Open redirect

Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL...

CVE-2014-0846

Cross-site scripting XSS vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-0844

IBM CVE-2014-0844 affects IBM Rational Requirements Composer (RRC) 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6. The vulnerability is described as an unspecified remote-authenticated data exposure via unknown vectors. The connected CVE collect...

CVE-2014-0844

Unspecified vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to read arbitrary data via unknown vectors...

CVE-2014-0845

Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL...

postgresql: possible buffer overflow flaws

Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, a different vulnerability than CVE-2014-0063...

postgresql: privilege escalation via procedural language validator functions

The validator functions for the procedural languages PLs in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is 1 defined in another language or 2 not allowed to b...

postgresql: integer overflows leading to buffer overflows

Multiple integer overflows in the pathin and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflo...

CVE-2014-2040

Multiple cross-site scripting XSS vulnerabilities in the 1 callbackmulticheck, 2 callbackradio, and 3 callbackwysiwygin functions in mfrhclass.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inje...

CVE-2014-2040

CVE-2014-2040 corresponds to multiple stored XSS vulnerabilities in the WordPress Media File Renamer plugin (v1.7.0). The issues affect the plugin’s settings API callbacks (callback_multicheck, callback_radio, callback_wysiwygin) in mfrh_class.settings-api.php, allowing remote authenticated users...

CVE-2014-2090

Multiple cross-site scripting XSS vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tar, 2 tarval, or 3 title parameter...

CVE-2014-2088

Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an uploadfiles action to the uploadFiles command, and then accessing the .php file via a direct request to a certain clientid pathname...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via 1 the group parameter to admin/addgroup.php, 2 the htmlblob parameter to admin/addhtmlblob.php, the 3 title or 4 url parameter to admin/addbookmark.php,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tar, 2 tarval, or 3 title parameter...

CVE-2014-2033

The caching feature in SGOS in Blue Coat ProxySG 5.5 through 5.5.11.3, 6.1 through 6.1.6.3, 6.2 through 6.2.15.3, 6.4 through 6.4.6.1, and 6.3 and 6.5 before 6.5.4 allows remote authenticated users to bypass intended access restrictions during a time window after account deletion or modification ...

Design/Logic Flaw

The caching feature in SGOS in Blue Coat ProxySG 5.5 through 5.5.11.3, 6.1 through 6.1.6.3, 6.2 through 6.2.15.3, 6.4 through 6.4.6.1, and 6.3 and 6.5 before 6.5.4 allows remote authenticated users to bypass intended access restrictions during a time window after account deletion or modification ...

CVE-2014-2090

Multiple cross-site scripting XSS vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tar, 2 tarval, or 3 title parameter...

CVE-2014-0334

CMS Made Simple (1.11.x) has multiple XSS vulnerabilities (CVE-2014-0334) exploitable via many admin parameters (admin/addgroup.php, admin/addhtmlblob.php, admin/addbookmark.php, admin/copystylesheet.php, admin/copytemplate.php, admin/editbookmark.php, admin/listtemplates.php, admin/listcss.php, ...

CVE-2014-0334

Multiple cross-site scripting XSS vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via 1 the group parameter to admin/addgroup.php, 2 the htmlblob parameter to admin/addhtmlblob.php, the 3 title or 4 url parameter to admin/addbookmark.php,...