CVE-2014-3712

Katello allows remote attackers to cause a denial of service memory consumption via the 1 mode parameter in the setuputils function in contentsearchcontroller.rb or 2 action parameter in the respond function in api/apicontroller.rb in app/controllers/katello/, which is passed to the tosym method...

PT-2014-5466

Name of the Vulnerable Software and Affected Versions Katello affected versions not specified Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, through two vulnerable parameters: - the mode parameter in the setup utils function in content...

PT-2014-8357

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 2.6.0 Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter to "install/index.php" API endpoint. Recommendations For versions prior to 2.6....

CVE-2014-7985: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter to install/index.php...

PT-2014-7129

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 3.4.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the action or nsextt parameter to "oc-admin/index.php" or the nsextt parameter in an "items reported...

Cross site scripting

Cross-site scripting XSS vulnerability in client-assist.php in the dsSearchAgent: WordPress Edition plugin 1.0-beta10 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

PT-2014-5951

Name of the Vulnerable Software and Affected Versions dsSearchAgent: WordPress Edition plugin version 1.0-beta10 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the action parameter i...

CVE-2014-4522: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in client-assist.php in the dsSearchAgent: WordPress Edition plugin 1.0-beta10 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2014-4521

Cross-site scripting XSS vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

Yblog uss.php action Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/20280/info Yblog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage these issues to have arbitrary script code execute in...

BulletScript MailList bsml.pl Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9311/info It has been reported that BulletScript MailList may be prone to an information disclosure vulnerability that may allow remote attackers to gain access to sensitive information. The issue is reported to be presen...

PT-2014-5950

Name of the Vulnerable Software and Affected Versions dsIDXpress IDX plugin versions prior to 2.1.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the action parameter in the...

CVE-2014-4521: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

PYSEC-2014-16

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

Cross site scripting

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

PYSEC-2014-16

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

CVE-2012-6131

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

CVE-2012-6131: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

CVE-2014-2092

Cross-site scripting XSS vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that...

PT-2014-4480

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 1.11.10 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the action parameter in the editorFrame.php file. This is a distinct issue from previousl...