CVE-2008-3100

Cross-site scripting XSS vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter in a getpasswd action to register.php...

CVE-2008-3359

SQL injection vulnerability in register.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2008-3359

SQL injection vulnerability in register.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely...

Cross site scripting

Cross-site scripting XSS vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter in a getpasswd action to register.php...

CVE-2008-3359: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in register.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2008-3100: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter in a getpasswd action to register.php...

CVE-2008-2814

Cross-site scripting XSS vulnerability in WallCity-Server Shoutcast Admin Panel 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter to the login interface. NOTE: the provenance of this information is unknown; the details are obtained solely from third par...

CVE-2008-2814

Cross-site scripting XSS vulnerability in WallCity-Server Shoutcast Admin Panel 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter to the login interface. NOTE: the provenance of this information is unknown; the details are obtained solely from third par...

CVE-2008-2814: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in WallCity-Server Shoutcast Admin Panel 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter to the login interface. NOTE: the provenance of this information is unknown; the details are obtained solely from third par...

Sql injection

Multiple SQL injection vulnerabilities in Acidcat CMS 3.4.1 allow remote attackers to execute arbitrary SQL commands via the 1 cID parameter to default.asp and the 2 username parameter to mainlogin2.asp...

CVE-2008-1990: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Acidcat CMS 3.4.1 allow remote attackers to execute arbitrary SQL commands via the 1 cID parameter to default.asp and the 2 username parameter to mainlogin2.asp...

Sql injection

Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 kqid parameter to a articletext.php and b articletextonly.php and the 2 username parameter to c logincheck.php...

viewuser.action has an XSS problem around username

Steps to reproduce: create a user with username: foo"alert'hello';span class="ff you should get an alert when you are redirected to viewuser.action to view the user you just created...

Cross site scripting

Cross-site scripting XSS vulnerability in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter to aspAdmin/deleteUser.asp, a different vector than CVE-2008-1174. NOTE: the provenance of this information is unknown; the details are obtaine...

CVE-2008-1174

Cross-site scripting XSS vulnerability in editUser.asp in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2008-1174: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in editUser.asp in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to inscription.php, 2 courseCode parameter to main/calendar/myagenda.php, 3 category parameter to main/admin/coursecategory.php, 4 message...

Directory traversal

Directory traversal vulnerability in viewmember.php in Public Warehouse LightBlog 9.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the username parameter...

CVE-2008-0840

Directory traversal vulnerability in viewmember.php in Public Warehouse LightBlog 9.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the username parameter...

CVE-2008-0840: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in viewmember.php in Public Warehouse LightBlog 9.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the username parameter...