6663 matches found
CVE-2013-1471
Multiple cross-site scripting XSS vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMail Identity-Based Encryption IBE appliances allow user-assisted remote attackers to inject arbitrary web script or HTML via 1 the Add field for the Black List under Antispam...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in admin/login in X3 CMS 0.4.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, 2 username, or 3 password parameter...
Console: XSS in invoke operation
It was found that the parameters passed to operation invocations on the JMX console were not properly sanitized. Remote attackers could use this flaw to inject arbitrary web script or HTML into the JMX console...
CVE-2012-6506
Multiple cross-site scripting XSS vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter in zing.inc.php or 2 notes parameter in fws/pages-front/onecheckout.php...
Cross site scripting
Cross-site scripting XSS vulnerability in the nBill comnbill component 2.3.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the message parameter in an income action to administrator/index.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 search field, or the 2 Author or 3 selectsort parameters in an advanced search...
CVE-2012-6517
DiY-CMS 1.0 is affected by multiple XSS vulnerabilities allowing remote attackers to inject arbitrary script/HTML via (1) the question parameter to /modules/poll/add.php and (2) the question or (3) the answer parameter to /modules/poll/edit.php. The root cause is unsafe handling of input leading ...
CVE-2012-6514
CVE-2012-6514 is a Cross-site Scripting (XSS) vulnerability in the Joomla! environment using the nBill (com_nbill) component 2.3.2 . The issue occurs when an attacker can inject arbitrary web script or HTML via the message parameter in an income action to administrator/index.php . The CVSS metric...
Cross site scripting
Cross-site scripting XSS vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an unspecified sequence of loading of documents and loading of data: URLs...
CVE-2012-3871
Cross-site scripting XSS vulnerability in data/hybrid/ihybrid.php in Open Constructor 3.12.0 allows remote authenticated users to inject arbitrary web script or HTML via the header parameter...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in objects/createobject.php in Open Constructor 3.12.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 name or 2 description parameter...
CVE-2012-4932
CVE-2012-4932 corresponds to multiple Cross-Site Scripting (XSS) vulnerabilities in SimpleInvoices prior to stable-2012-1-CIS3000. Provided connected sources confirm numerous injectable fields (e.g., managing/index parameters; Email, Customer Name, Address fields; PayPal and other fields; Invoice...
CVE-2012-3872
Multiple cross-site scripting XSS vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via 1 the result parameter to data/file/edit.php, 2 the q parameter to confirm.php, or 3 the keyword parameter to users/users.php...
CVE-2012-5606
OwnCloud contains multiple XSS vulnerabilities in versions before 4.0.9 and 4.5.0. The flaws allow remote injection of arbitrary scripts/HTML via (1) file name in apps/files_versions/js/versions.js, (2) apps/files/js/filelist.js, or (3) event title in 3rdparty/fullcalendar/js/fullcalendar.js. Roo...
CVE-2012-5175
CVE-2012-5175 concerns an XSS vulnerability in KENT-WEB ACCESS REPORT (v4.2 and earlier). The issue arises in processing of access-log data, enabling remote attackers to inject arbitrary web script or HTML that may execute in a user’s browser. Affected product: ACCESS REPORT by KENT-WEB; versions...
CVE-2012-6040
CVE-2012-6040 corresponds to a cross-site scripting (XSS) flaw in the File King Advanced File Management 1.4 package. The vulnerability affects the users.php component and allows remote attackers to inject arbitrary web script or HTML by manipulating the page parameter. The primary sources descri...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 find or 2 replace fields to havalite/findReplace.php; 3 username parameter to havalite/havalogin.php, 4 the Edit Article module, or 5 havapost.ph...
Cross site scripting
Cross-site scripting XSS vulnerability in the "extra" details in the DiffSource.getrow function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" lin...
CVE-2012-5888
CVE-2012-5888 describes a cross-site scripting (XSS) vulnerability in the TYPO3 extension Basic SEO Features (seo_basics) prior to version 0.8.2. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Public sources cite this vulnerability and provide an...