CVE-2014-2090

CVE-2014-2090 affects ILIAS 4.4.1 and earlier, with multiple XSS in ilias.php that allow remote authenticated users to inject arbitrary script or HTML via the tar, tar_val, or title parameters. The vulnerability is documented across NVD/NVD-derived entries and corroborated by OpenVAS, which lists...

CVE-2014-2088

Summary : CVE-2014-2088 refers to an unrestricted file upload in ILIAS 4.4.1 (ilias.php) that allows remote authenticated users to execute arbitrary PHP code by uploading a .php filename via the upload_files action to the uploadFiles command and then accessing the uploaded file through a client_i...

CVE-2014-2067

Cross-site scripting XSS vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."...

CVE-2014-1888

Cross-site scripting XSS vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-188...

Cross site scripting

Cross-site scripting XSS vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."...

CVE-2014-2067

Cross-site scripting XSS vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."...

CVE-2014-2059

Directory traversal vulnerability in the CLI job creation hudson/cli/CreateJobCommand.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name...

CVE-2014-2067

Cross-site scripting XSS vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."...

CVE-2014-1888

Cross-site scripting XSS vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-188...

CVE-2014-2059

Directory traversal vulnerability in the CLI job creation hudson/cli/CreateJobCommand.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name...

CVE-2014-2067

CVE-2014-2067 is a cross-site scripting (XSS) vulnerability in Jenkins, specifically in java/hudson/model/Cause.java. The issue allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note". Affected versions are Jenkins before 1.551 and LTS before 1.532.2. Th...

CVE-2014-0874

Cross-site scripting XSS vulnerability in IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter...

CVE-2014-0874

CVE-2014-0874 describes a reflected cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.x up to but not including 2.0.2.2-ICN-FP002. The issue arises from insufficient encoding of input in request parameters, allowing remote authenticated users to inject arbitrary web script or HT...

CVE-2014-0874

Cross-site scripting XSS vulnerability in IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter...

CVE-2014-0858

IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to bypass intended access restrictions and conduct deleteAction attacks via a modified URL...

Design/Logic Flaw

IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to bypass intended access restrictions and conduct deleteAction attacks via a modified URL...

CVE-2014-2102

Cisco Unified Contact Center Express Unified CCX does not properly restrict the content of the CCMConfig page, which allows remote authenticated users to obtain sensitive information by examining this content, aka Bug ID CSCum95575...

CVE-2014-0820

Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors...