CVE-2013-0305

The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information...

CVE-2012-6339

Multiple cross-site scripting XSS vulnerabilities in the administrative web interface in Cerberus FTP Server before 5.0.6.0 allow 1 remote attackers to inject arbitrary web script or HTML via a log entry that is not properly handled within the Log Manager component, and might allow 2 remote...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the administrative web interface in Cerberus FTP Server before 5.0.6.0 allow 1 remote attackers to inject arbitrary web script or HTML via a log entry that is not properly handled within the Log Manager component, and might allow 2 remote...

CVE-2012-5367

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to 1 viewCustomers, 2 viewPayGrades, or 3 viewSystemUsers in symfony/web/index.php/admin/, as demonstrated using cross-site reques...

Directory traversal

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. dot dot in the deld parameter. NOTE: this can be leveraged using CSRF CVE-2012-5450 to allow remote...

Sql injection

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to 1 viewCustomers, 2 viewPayGrades, or 3 viewSystemUsers in symfony/web/index.php/admin/, as demonstrated using cross-site reques...

CVE-2012-5367

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to 1 viewCustomers, 2 viewPayGrades, or 3 viewSystemUsers in symfony/web/index.php/admin/, as demonstrated using cross-site reques...

FW: =| Security Advisory - TP-LINK TL-WR841N XSS (Cross Site Scripting) |=

=| Security Advisory - TP-LINK TL-WR841N XSS Cross Site Scripting |= Issue: TL-WR841N 300Mbps Wireless N Router by "TP-LINK" Firmware Version: 3.13.9 Build 120201 Rel.54965n and Below Discovered Date: 17/11/2012 Author: Matan Azugi [email protected] Product Vendor:...

TP-LINK TL-WR841N 3.13.9 Cross Site Scripting

=| Security Advisory - TP-LINK TL-WR841N XSS Cross Site Scripting |= Issue: TL-WR841N 300Mbps Wireless N Router by "TP-LINK" Firmware Version: 3.13.9 Build 120201 Rel.54965n and Below Discovered Date: 17/11/2012 Author: Matan Azugi [email protected] Product Vendor:...

Cross site scripting

Cross-site scripting XSS vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message...

CVE-2012-4938

Cross-site scripting XSS vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message...

CVE-2012-4938

Cross-site scripting XSS vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message...

CVE-2012-4938: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message...

Cross site scripting

Cross-site scripting XSS vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcmsodevelopername parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-53...

CVE-2012-5388

Cross-site scripting XSS vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcmsodevelopername parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-53...

WordPress White Label CMS Plugin <= 1.5 - XSS

Because of this vulnerability in wlcms-plugin.php, the authenticated administrators can inject arbitrary web script or HTML via the "wlcmsodevelopername" parameter. Solution Update the plugin...

CVE-2012-3393

Cross-site scripting XSS vulnerability in repository/lib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 allows remote authenticated administrators to inject arbitrary web script or HTML by renaming a repository...

Cross site scripting

Cross-site scripting XSS vulnerability in cohort/editform.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field. NOTE: this vulnerability exists...

CVE-2012-3396

Cross-site scripting XSS vulnerability in cohort/editform.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field. NOTE: this vulnerability exists...

CVE-2012-3393

Cross-site scripting XSS vulnerability in repository/lib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 allows remote authenticated administrators to inject arbitrary web script or HTML by renaming a repository...