Accentis Cross-Site Scripting Vulnerability

Accentis is a suite of management software for ERP, CRM, payroll, production and inventory management. Accentis fails to properly filter the 'ctl00$cphcontent$uigformState' parameter, allowing remote attackers to exploit the vulnerability by injecting malicious script or HTML code, obtaining...

Code injection

Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the commentstate parameter...

UBUNTU-CVE-2013-2184

Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the commentstate parameter...

PT-2015-3545

Name of the Vulnerable Software and Affected Versions Movable Type versions prior to 5.2.6 Description The issue arises from the incorrect usage of the Storable::thaw function, allowing remote attackers to execute arbitrary code through the comment state parameter. This enables attackers to...

Cross site request forgery (csrf)

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...

CVE-2013-4562

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...

CVE-2013-4562: Cross-Site Request Forgery (CSRF)

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...

PT-2014-2831

Name of the Vulnerable Software and Affected Versions omniauth-facebook gem versions 1.4.1 through 1.4.1 Description The issue allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter, due to improper storage of the session parameter. Recommendations For...

CVE-2014-2325

Multiple cross-site scripting XSS vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the 1 state parameter to objects/who/index.htm or 2 User email address to quarantine/spam/manage.htm...

CVE-2014-2325: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the 1 state parameter to objects/who/index.htm or 2 User email address to quarantine/spam/manage.htm...

PT-2014-4625

Name of the Vulnerable Software and Affected Versions Proxmox Mail Gateway versions prior to 3.1-5829 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the state parameter to the "objects/who/index.htm" endpoint or the User email addres...

CVE-2012-1777

SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter...

PT-2012-3528

Name of the Vulnerable Software and Affected Versions F5 FirePass versions 6.0.0 through 6.1.0 F5 FirePass versions 7.0.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the state parameter in the my.activation.php3 file. Recommendations For F...

CVE-2012-1777: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter...

Sql injection

SQL injection vulnerability in index.php in HauntmAx Haunted House Directory Listing CMS allows remote attackers to execute arbitrary SQL commands via the state parameter in a listings action...

CVE-2010-2312: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in HauntmAx Haunted House Directory Listing CMS allows remote attackers to execute arbitrary SQL commands via the state parameter in a listings action...

CVE-2006-6205

Multiple cross-site scripting XSS vulnerabilities in result.asp in Enthrallweb eHomes allow remote attackers to inject arbitrary web script or HTML via the 1 city or 2 State parameter...

PT-2006-6835 · Enthrallweb · Enthrallweb Ehomes

Name of the Vulnerable Software and Affected Versions: Enthrallweb eHomes affected versions not specified Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the city or State...