Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to inject arbitrary web script or HTML via the cID parameter in a document action. NOTE: the provenance of this information is unknown; the details are obtained solely from thir...

CVE-2009-0260

CVE-2009-0260: Multiple XSS vulnerabilities in MoinMoin, via action/AttachFile.py for WikiSandBox in versions before 1.8.1; attackers can inject script/HTML through AttachFile parameters rename or drawing (basename). Remote exploitation possible; remediation is upgrading to MoinMoin 1.8.1 or late...

CVE-2008-5917

The CVE-2008-5917 entry describes a Cross-site scripting (XSS) vulnerability in Horde Application Framework’s Text_Filter/Filter/xss.php, affecting Horde 3.2.2 and 3.3. It is reported when using Internet Explorer, allowing remote attackers to inject arbitrary web script or HTML via unknown vector...

CVE-2008-5858

CVE-2008-5858 relates to KnowledgeTree product families with Cross-Site Scripting (XSS) in multiple versions. Affected software/components include KnowledgeTree Open Source prior to 3.5.4a and related KnowledgeTree deployments referenced in connected documents (e.g., KnowledgeTree 3.x line). The ...

Megacubo 5.0.7 (mega://) Remote eval() Injection Exploit

Exploit for unknown platform in category remote exploits ======================================================== Megacubo 5.0.7 mega:// Remote eval Injection Exploit ======================================================== a href='mega://play|con...

CVE-2008-4305: Improper Control of Generation of Code

Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI...

CVE-2008-5264

The CVE-2008-5264 entry documents a Cross-site scripting (XSS) flaw in Tornado Knowledge Retrieval System versions 4.2 and earlier, affecting the searcher.exe component via the p parameter in a root action. Public sources do not provide additional exploit details, proof-of-exploit, affected versi...

CVE-2008-5214

CVE-2008-5214 refers to a cross-site scripting (XSS) vulnerability in ClanLite. The affected component is the web page calendrier.php ( ClanLite 2.2006.05.20 ), with the annee parameter enabling remote attackers to inject arbitrary web script or HTML. OpenVAS additionally flags potential SQL inje...

CVE-2008-5068

Multiple cross-site scripting XSS vulnerabilities in Kmita Gallery allow remote attackers to inject arbitrary web script or HTML via the 1 begin parameter to index.php and the 2 searchtext parameter to search.php. NOTE: the provenance of this information is unknown; the details are obtained solel...

CVE-2008-4818

CVE-2008-4818 is an XSS in Adobe Flash Player related to how HTTP response headers are interpreted. The vulnerability affects Flash Player 9.0.124.0 and earlier. In Red Hat advisories, fixes are delivered via flash-plugin updates: RHSA-2008-0980 for older RHEL3/4/others (updating to Flash Player ...

CVE-2008-4775

Cross-site scripting XSS vulnerability in pmdpdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and...

KLA10240 CI vulnerability in Kontiki DMS

An XSS vulnerability was found in Kontiki DMS. By exploiting this vulnerability malicious users can inject arbitrary web script. This vulnerability can be exploited remotely via a specially designed call. Original advisories - Exploitation Public exploits exist for this vulnerability. CVE list...

CVE-2008-3664

Multiple cross-site scripting XSS vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTML via 1 the real name field, related to the user list; 2 the target parameter to login.php, 3 the title parameter to activities/some.php, 4 the companyname parameter to...

FreeBSD Ports: phpmyadmin, phpMyAdmin

The remote host is missing an update to the system as announced in the referenced advisory. VID 882ef43b-901f-11d9-a22c-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: squirrelmail, ja-squirrelmail

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: phpmyadmin, phpMyAdmin

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Code injection

Swfdec 0.6 before 0.6.8 allows remote attackers to cause a denial of service application crash via a 1x1 JPEG image...

CVE-2008-3482

Cross-site scripting XSS vulnerability in the error page feature in Panasonic Network Camera BL-C111, BL-C131, BB-HCM511, BB-HCM531, BB-HCM580, BB-HCM581, BB-HCM527, and BB-HCM515 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-3422

Multiple cross-site scripting XSS vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to 1 HtmlControl.cs PreProcessRelativeReference, 2 HtmlForm.cs RenderAttributes, 3 HtmlInputButton...

CVE-2008-3379

CVE-2008-3379 affects Snark VisualPic 0.3.1 and is a cross-site scripting (XSS) vulnerability. The issue arises from insufficient input sanitization of the pic parameter in the default URI, allowing remote attackers to inject arbitrary web script/HTML that executes in the victim’s browser. The vu...