CVE-2011-5251: Improper Input Validation

Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action...

PT-2012-2223

Name of the Vulnerable Software and Affected Versions vBulletin versions 4.1.3 and earlier Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via the url parameter in a "lostpw" action in the "forum/login.php"...

Open redirect

Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter...

CVE-2012-4489

Open redirect vulnerability in the secureloginsecureredirect function in the Secure Login module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter...

CVE-2012-5321

tiki-featuredlink.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection."...

CVE-2012-4824

Open redirect vulnerability in servlet/traveler in IBM Lotus Notes Traveler 8.5.3 before 8.5.3.3 Interim Fix 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirectURL parameter...

Reflected xss in the System Notifications administration resource

The System Notifications administration resource is vulnerable to reflected xss through the url used to address the resource and any included parameters. For example: 1. http://localhost:8085/admin19279%27%20+%20alert%281%29%20+%27//904/viewSystemNotifications.action 2...

PT-2012-5920

Name of the Vulnerable Software and Affected Versions TikiWiki CMS/Groupware version 8.3 Description The issue allows remote attackers to load arbitrary web site pages into frames, which can be used to conduct phishing attacks. This is achieved via the url parameter in the tiki-featured link.php...

Open redirect

Open redirect vulnerability in index.php in ocPortal before 7.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter...

CVE-2012-5224

PHP remote file inclusion vulnerability in vb/includes/vbacmpsincludebottom.php in vBadvanced CMPS 3.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pagestemplate parameter...

CVE-2012-5225

Cross-site scripting XSS vulnerability in webscr.php in xClick Cart 1.0.1 and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the shoppingurl parameter...

CVE-2012-5103: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in action/add-submit.php in Ggb Guestbook 0.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 url or 2 message parameter...

CVE-2012-4891

Cross-site scripting XSS vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vector than CVE-2012-4889. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2012-4891

Cross-site scripting XSS vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vector than CVE-2012-4889. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2012-4891: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vector than CVE-2012-4889. NOTE: the provenance of this information is unknown; the details are obtained...

PT-2012-5640

Name of the Vulnerable Software and Affected Versions ManageEngine Firewall Analyzer version 7.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the url parameter in the fw/index2.do endpoint. This is a different attack...

Open redirect

Open redirect vulnerability in views/authforms.py in OpenStack Dashboard Horizon Essex 2012.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/. NOTE: this issue was originally assigned CVE-2012-3542 by...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 file names to apps/userldap/settings.php; 2 url or 3 title parameter to apps/bookmarks/ajax/editBookmark.php; 4 tag or 5 page parameter to...

CVE-2012-1933

Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4 before RC4, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSgcampsiteDir parameter to 1 include/phorumload.php, 2 conf/installconf.php, or 3...

Cross site scripting

Cross-site scripting XSS vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter...