CVE-2014-4738

Fortinet FortiWeb 5.x prior to 5.2.1 is affected by CVE-2014-4738 (XSS) in the web management interface URLs /user/ldap_user/check_dlg and /user/radius_user/check_dlg due to insufficient input validation. This allows remote attackers to inject arbitrary JavaScript in an administrative browser ses...

Cross site scripting

Cross-site scripting XSS vulnerability in share/pnp/application/views/kohanaerrorpage.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching 1 share/pnp/application/views/kohanaerrorpage.php or 2 share/pnp/application/views/template.php, leading to improper handling...

CVE-2014-3821: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SRX Web Authentication webauth in Juniper Junos 11.4 before 11.4R11, 12.1X44 before 12.1X44-D34, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10 allows remote attackers to inject arbitrary web script or HTML via...

Cross site scripting

Cross-site scripting XSS vulnerability in the Blogstand Banner blogstand-smart-banner plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bsblogid parameter to wp-admin/options-general.php...

CVE-2014-4855

Cross-site scripting XSS vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a user description. NOTE: some of these details are obtained from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in group/controlpanel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the 1 2firstName, 2 2lastName, or 3 2middleName parameter...

CVE-2014-3315

Cross-site scripting XSS vulnerability in viewfilecontents.do in the Dialed Number Analyzer DNA component in Cisco Unified Communications Manager allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCup76308...

Debian Security Advisory DSA 2975-1 (phpmyadmin - security update)

Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-4995 Authenticated users could inject arbitrary web script or HTML via a crafted SQL query. CVE-2013-49...

Cross site scripting

Cross-site scripting XSS vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header...

CVE-2014-4002

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the 1 drpaction parameter to cdef.php, 2 datainput.php, 3 dataqueries.php, 4 datasources.php, 5 datatemplates.php, 6 graphtemplates.php, 7 graphs.php, 8 host.php, or...

CVE-2014-4002

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the 1 drpaction parameter to cdef.php, 2 datainput.php, 3 dataqueries.php, 4 datasources.php, 5 datatemplates.php, 6 graphtemplates.php, 7 graphs.php, 8 host.php, or...

Cross site scripting

Cross-site scripting XSS vulnerability in picasaupload.php in the WP-Picasa-Image plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the postid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2014-3737

CVE-2014-3737 is a reflected XSS in Storesprite (Lamp Design Limited) via templates/defaultheader.php, exploitable when using the currency selection dropdown that triggers URI PATH_INFO to brand.php. Affects Storesprite v7 and likely earlier; vendor patch released on 2014-06-19 to fix the issue (...

CVE-2014-4581

Cross-site scripting XSS vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the starttime0 parameter to firewallschedule.php, 2 the rssfeed parameter to rss.widget.php, 3 the servicestatusfilter parameter to...

PT-2014-6008

Name of the Vulnerable Software and Affected Versions WP RESTful plugin versions 0.1 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the oauth callback parameter to "html api authorize.php", or the oauth token temp or oaut...

CVE-2014-4528

Multiple cross-site scripting XSS vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator fbpromotions plugin 1.3.4 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 promotype, 2 fbeditaction, or 3 promoid...

CVE-2014-2512: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4 before P19, and 7.4.4 SP1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...