CVE-2008-3301

CVE-2008-3301 concerns BilboBlog 0.2.1, with multiple XSS flaws. The vulnerabilities originate from conflicting code in widget.php and affect several entry points: admin/update.php (content), head.php (titleId), footer.php (t_lang[lang_copyright]), admin/ default URI (content), admin/homelink.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Claroline before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via 1 the cwd parameter in a rqMkHtml action to document/rqmkhtml.php, or the query string to 2 announcements/announcements.php, 3 calendar/agenda.php, 4...

CVE-2008-3237

Cross-site scripting XSS vulnerability in forwardtofriend.php in ITechBids 7.0 Gold allows remote attackers to inject arbitrary web script or HTML via the productid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Xomol CMS 1.2 allows remote attackers to inject arbitrary web script or HTML via the currenturl parameter in a tellafriend action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informati...

CVE-2008-3198

CVE-2008-3198 affects Mozilla Firefox 3.x prior to 3.0.1, enabling remote script injection into a chrome document (e.g., via a XUL error page). The vulnerability is potentiated by CVE-2008-2933, and some advisories indicate upgrading Firefox to 3.0.1 to address the issue. Connected sources (e.g.,...

CVE-2008-2991

Cross-site scripting XSS vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Help Errors log...

CVE-2008-3069

CVE-2008-3069 corresponds to multiple cross-site scripting (XSS) flaws in MyBB prior to version 1.2.13. The affected components are (1) portal.php and (2) inc/functions_post.php, with the root cause described as untrusted input leading to script/HTML injection. This could enable remote attackers ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Send-A-Card srsendcard extension 2.2.2 and earlier for TYPO3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Gravity Board X GBX 2.0 Beta allows remote attackers to inject arbitrary web script or HTML via the subject parameter in a postnewsubmit aka create new thread action...

CVE-2008-2998

Multiple cross-site scripting XSS vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in chathead.php in MM Chat 1.5 allow remote attackers to inject arbitrary web script or HTML via the 1 sitename and 2 wmessage parameters...

CVE-2008-2960

CVE-2008-2960 is a cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7 that occurs when register_globals is enabled and .htaccess support is disabled. It allows remote attackers to inject arbitrary web script or HTML via scripts in libraries/. The connected documents confirm the ...

CVE-2008-2462

CVE-2008-2462 concerns a cross-site scripting (XSS) vulnerability in Resin’s viewfile command. The issue allows remote attackers to inject arbitrary web script or HTML via the file parameter. Affected Resin versions are before 3.0.25 and 3.1.x before 3.1.4; remediation is to upgrade to Resin 3.0....

CVE-2008-2462

Cross-site scripting XSS vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in template2.php in PEGames allow remote attackers to inject arbitrary web script or HTML via the 1 sitetitle, 2 sitenav, 3 sitemain, and 4 sitealt parameters. NOTE: the provenance of this information is unknown; the details are obtained solely fr...

CVE-2008-2871

CVE-2008-2871 is an XSS vulnerability in PEGames’ template2.php, allowing remote attackers to inject arbitrary script via the URL parameters sitetitle, sitenav, sitemain, and sitealt. The connected documents confirm the issue lies in unencoded or unsanitized user input in that template file, enab...

CVE-2008-2839

CVE-2008-2839 is a reported cross-site scripting (XSS) vulnerability in the Traindepot 0.1 search module. The issue arises when an attacker can inject arbitrary script or HTML through the query parameter to index.php, potentially affecting users who load the affected page. The provided data ident...

Cross site scripting

Cross-site scripting XSS vulnerability in WallCity-Server Shoutcast Admin Panel 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter to the login interface. NOTE: the provenance of this information is unknown; the details are obtained solely from third par...

CVE-2008-2766

Cross-site scripting XSS vulnerability in Xigla Absolute Image Gallery XE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in 1 admin/search.asp and 2 gallery.asp...

CVE-2008-2756

Cross-site scripting XSS vulnerability in admin/users.asp in Xigla Absolute Control Panel XE 1.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter and other unspecified parameters. NOTE: some of these details are obtained from third party information...