PT-2017-14441

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.0 Patch 5 Description The issue allows unauthenticated remote database copying. This is possible because setup.php exposes functionality for cloning an existing site to an arbitrary attacker-controlled MySQL serve...

CVE-2017-16540: Exposure of Sensitive Information to an Unauthorized Actor

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...

ILIAS Detection (HTTP)

HTTP based detection of ILIAS eLearning. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.140443";...

CVE-2016-9889

Some forms with the parameter geozoomleveltofoundlocation in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and articleimage.php. The impact is XSS...

PT-2016-7863

Name of the Vulnerable Software and Affected Versions Tiki Wiki CMS versions 12.x through 12.9 LTS Tiki Wiki CMS versions 15.x through 15.2 LTS Tiki Wiki CMS versions 16.x through 16.0 Description The issue is related to the lack of input sanitization for the geo zoomlevel to found location...

CVE-2016-9889: Improper Neutralization of Input During Web Page Generation

Some forms with the parameter geozoomleveltofoundlocation in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and articleimage.php. The impact is XSS...

phpmyadmin2. 8. 0. 3 arbitrary file include vulnerability

0x00 overview phpmyadmin vulnerability exists in the known version is 2.8.0.3 rest version unknown This test version is 2. 8. 0. 3 Many within the network system in this version, the external network is also not a few! 0x01 vulnerability analysis See there are holes in the file code...

CVE-2015-3648

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the defaultlanguage parameter...

Directory traversal

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the defaultlanguage parameter...

CVE-2015-3648

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the defaultlanguage parameter...

PT-2015-6255

Name of the Vulnerable Software and Affected Versions ResourceSpace versions prior to 7.2.6727 Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the defaultlanguage parameter of the...

CVE-2015-3648: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the defaultlanguage parameter...

CVE-2014-9059

lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting XSS attacks via UTF-7 characters during interaction with AJAX scripts...

CVE-2014-9059

lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting XSS attacks via UTF-7 characters during interaction with AJAX scripts...

CVE-2014-9059: Improper Neutralization of Input During Web Page Generation

lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting XSS attacks via UTF-7 characters during interaction with AJAX scripts...

CVE-2014-8365

Multiple cross-site scripting XSS vulnerabilities in Xornic Contact Us allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 email parameter to contact.php or 3 PATHINFO to setup.php, related to the "PHPSELF" variable...

CVE-2014-8365

CVE-2014-8365 affects the Xornic Contact Us component, with XSS weaknesses exploitable via the name or email fields of contact.php or by PATH_INFO to setup.php, related to the PHP_SELF variable. The connected documents confirm this vulnerability class but do not provide product version details, c...

CVE-2014-8365

Multiple cross-site scripting XSS vulnerabilities in Xornic Contact Us allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 email parameter to contact.php or 3 PATHINFO to setup.php, related to the "PHPSELF" variable...

PT-2014-8490

Name of the Vulnerable Software and Affected Versions Xornic Contact Us affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur vi...

CVE-2014-8365: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Xornic Contact Us allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 email parameter to contact.php or 3 PATHINFO to setup.php, related to the "PHPSELF" variable...