CVE-2012-4273

Cross-site scripting XSS vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter...

CVE-2012-2354

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL...

Design/Logic Flaw

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL...

CVE-2012-2354

Vulnerability summary (CVE-2012-2354): Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allow remote authenticated users to bypass the moodle/site:readallmessages capability and read arbitrary messages by tampering the URL parameter in the Recent conversations feature. The issue affects Moodle in...

Remote file inclusion

PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the subtype parameter...

SA-CONTRIB-2012-110 - Colorbox Node - Cross Site Scripting (XSS)

Colorbox Node gives the user the ability to display ANY page inside a colorbox modal without the header and footer. The module accepts some settings from URL parameters and didn't sufficiently validate them before printing them to the browser, allowing malicious users to inject script code into t...

CVE-2010-2021

Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, when non-clean to clean is enabled, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter...

Sql injection

SQL injection vulnerability in include/functionstrackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php...

CVE-2012-2762

SQL injection vulnerability in include/functionstrackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php...

PT-2012-4242

Name of the Vulnerable Software and Affected Versions Serendipity version 1.6.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the url parameter in the "comment.php" endpoint. Recommendations For Serendipity version 1.6.2, update to...

Serendipity 1.6.1 SQL Injection Vulnerability

Exploit for php platform in category web applications Product: Serendipity Vendor: Serendipity Team Vulnerable Versions: 1.6.1 and probably prior Tested Version: 1.6.1 Vendor Notification: 16 May 2012 Vendor Patch: 16 May 2012 Public Disclosure: 6 June 2012 Vulnerability Type: SQL injection CVE...

CVE-2012-2762: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in include/functionstrackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php...

CVE-2012-2924

PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

CVE-2011-4237

CRLF injection vulnerability in autologin.jsp in Cisco CiscoWorks Common Services 4.0, as used in Cisco Prime LAN Management Solution and other products, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter, aka Bug ID CSCtu186...

PT-2012-1824

Name of the Vulnerable Software and Affected Versions CiscoWorks Common Services version 4.0 Description A CRLF injection issue in autologin.jsp allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter. Recommendations For CiscoWor...

Open redirect

Open redirect vulnerability in index.php aka the Login Page in ownCloud before 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

CVE-2012-1787

Multiple cross-site scripting XSS vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 URL, 2 FILE, or 3 DOMAIN parameters...

CVE-2012-1787: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 URL, 2 FILE, or 3 DOMAIN parameters...

PT-2012-3538

Name of the Vulnerable Software and Affected Versions Webglimpse versions 2.20.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the URL, FILE, or DOMAIN parameters in the wgarcmin.cgi component. Recommendations For Webglimpse versions 2.20.0 a...