Cross site scripting

Cross-site scripting XSS vulnerability in the nBill comnbill component 2.3.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the message parameter in an income action to administrator/index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 search field, or the 2 Author or 3 selectsort parameters in an advanced search...

CVE-2012-6517

DiY-CMS 1.0 is affected by multiple XSS vulnerabilities allowing remote attackers to inject arbitrary script/HTML via (1) the question parameter to /modules/poll/add.php and (2) the question or (3) the answer parameter to /modules/poll/edit.php. The root cause is unsafe handling of input leading ...

CVE-2012-6514

CVE-2012-6514 is a Cross-site Scripting (XSS) vulnerability in the Joomla! environment using the nBill (com_nbill) component 2.3.2 . The issue occurs when an attacker can inject arbitrary web script or HTML via the message parameter in an income action to administrator/index.php . The CVSS metric...

PT-2013-1970

Name of the Vulnerable Software and Affected Versions Zingiri Web Shop plugin version 2.4.0 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the page parameter in zing.inc.php or the notes parameter in fws/pages-front/onecheckout.php...

CVE-2013-0010: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System Center Operations Manager Web Console XSS Vulnerability," a different vulnerability than CVE-2013-0009...

Cross site scripting

Cross-site scripting XSS vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an unspecified sequence of loading of documents and loading of data: URLs...

CVE-2012-4970: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web management interface on Polycom HDX Video End Points with UC APL software before 2.7.1.1J, and commercial software before 3.0.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-3871

Cross-site scripting XSS vulnerability in data/hybrid/ihybrid.php in Open Constructor 3.12.0 allows remote authenticated users to inject arbitrary web script or HTML via the header parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in objects/createobject.php in Open Constructor 3.12.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 name or 2 description parameter...

CVE-2012-4932

CVE-2012-4932 corresponds to multiple Cross-Site Scripting (XSS) vulnerabilities in SimpleInvoices prior to stable-2012-1-CIS3000. Provided connected sources confirm numerous injectable fields (e.g., managing/index parameters; Email, Customer Name, Address fields; PayPal and other fields; Invoice...

CVE-2012-3872

Multiple cross-site scripting XSS vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via 1 the result parameter to data/file/edit.php, 2 the q parameter to confirm.php, or 3 the keyword parameter to users/users.php...

CVE-2012-0428: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5606

OwnCloud contains multiple XSS vulnerabilities in versions before 4.0.9 and 4.5.0. The flaws allow remote injection of arbitrary scripts/HTML via (1) file name in apps/files_versions/js/versions.js, (2) apps/files/js/filelist.js, or (3) event title in 3rdparty/fullcalendar/js/fullcalendar.js. Roo...

PT-2012-6053

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.9 ownCloud versions prior to 4.5.0 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the file name to apps/files versions/js/versions.js or...

PT-2012-6208

Name of the Vulnerable Software and Affected Versions ManageEngine AssetExplorer version 5.6 before service pack 5614 Description The issue allows remote attackers to inject arbitrary web script or HTML via fields in XML asset data. This is achieved by exploiting the...

CVE-2012-5175

CVE-2012-5175 concerns an XSS vulnerability in KENT-WEB ACCESS REPORT (v4.2 and earlier). The issue arises in processing of access-log data, enabling remote attackers to inject arbitrary web script or HTML that may execute in a user’s browser. Affected product: ACCESS REPORT by KENT-WEB; versions...

CVE-2012-5541: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Twitter Pull module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.0-rc3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "data coming from Twitter."...

PT-2012-6016

Name of the Vulnerable Software and Affected Versions ShareThis module versions 7.x-2.x before 7.x-2.5 Description The issue allows remote authenticated users with the "administer sharethis" permission to inject arbitrary web script or HTML via unspecified vectors related to JavaScript settings...

PT-2012-6018

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 7.x Description A cross-site scripting XSS issue in the Time Spent module for Drupal allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions 6.x through 7.x, update the Time Spen...