SA-CONTRIB-2009-112 - Sections - Cross Site Scripting

The Sections module allows the creation of sections within a site. Each section has an installed template, theme or style attached to it. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting XSS vulnerability. Users who can take...

Horde 3.3.5 - Cross-Site Scripting

Horde 3.3.5 - Cross-Site Scripting source: https://www.securityfocus.com/bid/37351/info Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browse...

Horde 3.3.5 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/37351/info Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

Horde 3.3.5 - '/Administration Interface admin/cmdshell.php?PATH_INFO' Cross-Site Scripting

source: https://www.securityfocus.com/bid/37351/info Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

Horde 3.3.5 - Administration Interface adminsqlshell.php?PATH_INFO Cross-Site Scripting

Horde 3.3.5 - Administration Interface adminsqlshell.php?PATHINFO Cross-Site Scripting source: https://www.securityfocus.com/bid/37351/info Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this...

Sun Solaris AnswerBook2 Multiple Cross-Site Scripting Vulnerabilities

Sun Solaris AnswerBook2 is reported prone to multiple cross-site scripting vulnerabilities. These issues arise due to insufficient sanitization of user-supplied data facilitating execution of arbitrary HTML and script code in a user's browser. The following specific issues were identified: It is...

SmartMedia Module 0.85 Beta for XOOPS - categoryId Cross-Site Scripting

SmartMedia Module 0.85 Beta for XOOPS - categoryId Cross-Site Scripting source: https://www.securityfocus.com/bid/37156/info The SmartMedia module for XOOPS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this...

Mercury/32 <= v4.01b PH Server Module Buffer Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Mercury/32 %...

CyberCMS - 'faq.php' SQL Injection

source: https://www.securityfocus.com/bid/39698/info Cyber CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify dat...

CyberCMS - faq.php SQL Injection

CyberCMS - faq.php SQL Injection source: https://www.securityfocus.com/bid/39698/info Cyber CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

CubeCart 'productId' SQL Injection Vulnerability

CubeCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying...

klinza Professional CMS 5.0.1 - menulast.php Local File Inclusion

klinza Professional CMS 5.0.1 - menulast.php Local File Inclusion source: https://www.securityfocus.com/bid/37127/info The 'klinza professional cms' project is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow...

Xerver HTTP Response Splitting Vulnerability

Xerver is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data. Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client...

Oracle Database SUBSCRIPTION_NAME Parameter SQL Injection (CVE-2005-1197)

Oracle Database Server is an enterprise-level relational database application suite. To extend the functionality of the Oracle Database Server, extra packages of related program objects, i.e. procedures, functions, variables, constants, cursors, and exceptions, are provided to the database user i...

JiRos (Multiple Products) - fileslogin.asp Multiple SQL Injections

JiRos Multiple Products - fileslogin.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/37045/info Multiple JiRo's products are prone to multiple SQL-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data before using it in an SQL query...

PHD Help Desk 1.43 - solic_display.php?q_registros Cross-Site Scripting

PHD Help Desk 1.43 - solicdisplay.php?qregistros Cross-Site Scripting source: https://www.securityfocus.com/bid/37029/info PHD Help Desk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or...

PHD Help Desk 1.43 - caso_insert.php?URL Cross-Site Scripting

PHD Help Desk 1.43 - casoinsert.php?URL Cross-Site Scripting source: https://www.securityfocus.com/bid/37029/info PHD Help Desk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript...

WordPress Plugin Subscribe to Comments 2.0 - Multiple Cross-Site Scripting Vulnerabilities

WordPress Plugin Subscribe to Comments 2.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/37105/info The Subscribe to Comments plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently...

PHD Help Desk 1.43 - 'solic_display.php?q_registros' Cross-Site Scripting

source: https://www.securityfocus.com/bid/37029/info PHD Help Desk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site,...

PHD Help Desk 1.43 - 'area.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/37029/info PHD Help Desk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site,...