PT-2014-3003

Name of the Vulnerable Software and Affected Versions eXtplorer version 2.1.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to various files, including application.js.php in scripts/, and admin.php, copy move.php, functions.php, header.php,...

Dell SonicWALL NSA 2400 'stats/dashboard.jsp' Cross Site Scripting Vulnerability

Cross-site scripting XSS vulnerability in the Dashboard Backend service stats/dashboard.jsp in SonicWall Network Security Appliance NSA 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter. CVE: CVE-2014-2589 Last updated: March 12, 2018, 4:19 p.m...

Cross site scripting

Cross-site scripting XSS vulnerability in the login audit form in McAfee Cloud Single Sign On SSO allows remote attackers to inject arbitrary web script or HTML via a crafted password...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-7341

CVE-2013-7341 refers to multiple XSS vulnerabilities in Flowplayer Flash before 3.2.17, exploited via Moodle integrations up to Moodle 2.4.9 (and related 2.3.x, 2.4.x, 2.5.x, 2.6.x series). The vulnerabilities allow remote attackers to inject arbitrary scripts/HTML by (1) supplying a crafted play...

PT-2014-3179

Name of the Vulnerable Software and Affected Versions IBM QuickFile versions 1.0.0.0 through 1.0.0.0 before iFix 4 IBM QuickFile versions 1.1.0.1 through 1.1.0.1 before iFix 3 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, which i...

CVE-2011-3199

CVE-2011-3199 affects Domain Technologie Control (DTC) prior to version 0.34.1. The vulnerability is a set of cross-site scripting (XSS) flaws allowing remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket or (2) DNS and (3) MX form, demons...

Cross site scripting

Cross-site scripting XSS vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter...

CVE-2014-2280

SeedDMS (formerly LetoDMS/MyDMS) before version 4.3.4 is affected by a reflected XSS in the search feature. The vulnerability arises from the query parameter used by the search, allowing attackers to inject arbitrary scripts/HTML that are returned without proper validation or sanitization. Public...

CVE-2014-2219

CMSimple Classic 3.54 and earlier contains a reflected XSS in /whizzywig/wb.php where the d parameter is not properly sanitized. A remote attacker can induce a logged-in user to visit a crafted URL to execute arbitrary HTML/JavaScript in the browser. Vendor patch: fixed by the vendor on 2014-02-2...

CVE-2014-2280

Cross-site scripting XSS vulnerability in the search feature in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2014-2077

Open-Xchange AppSuite frontend is affected by an XSS in the email subject field, due to unsafe handling of aria tags in the top bar. The vulnerability allows remote attackers to inject arbitrary script/HTML in the victim’s browser context when viewing emails. Remediation provided by the vendor fi...

CVE-2013-0201

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 QUERYSTRING to core/lostpassword/templates/resetpassword.php, 2 mime parameter to apps/files/ajax/mimeicon.php, or 3 token parameter to...

CVE-2013-0201

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 QUERYSTRING to core/lostpassword/templates/resetpassword.php, 2 mime parameter to apps/files/ajax/mimeicon.php, or 3 token parameter to...

CVE-2013-2042

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the url parameter to 1 apps/bookmarks/ajax/addBookmark.php or 2 apps/bookmarks/ajax/editBookmark.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to shared files...

CVE-2013-2149

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to shared files...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the 1 quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin...

CVE-2013-2041

Multiple cross-site scripting XSS vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tag parameter to apps/bookmarks/ajax/addBookmark.php or 2 dir parameter to apps/files/ajax/newfile.php, which is passed to...

CVE-2013-2040

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...