162 matches found
CVE-2013-7343
Cross-site scripting XSS vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.3 allows remote attackers to inject arbitrary web script or HTML by using URL encoding within the callback parameter name. NOTE: this vulnerability exists because of an incomplete fix fo...
CVE-2013-7342: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.1 allows remote attackers to inject arbitrary web script or HTML via the callback parameter, a related issue to CVE-2013-7341...
CVE-2013-7343: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.3 allows remote attackers to inject arbitrary web script or HTML by using URL encoding within the callback parameter name. NOTE: this vulnerability exists because of an incomplete fix fo...
PT-2014-3379
Name of the Vulnerable Software and Affected Versions Flowplayer HTML5 version 5.4.3 Description The issue is related to a cross-site scripting XSS vulnerability in the Flash fallback feature. This vulnerability allows remote attackers to inject arbitrary web script or HTML by using URL encoding...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in BMC Service Desk Express SDE 10.2.1.95 allow remote attackers to inject arbitrary web script or HTML via the 1 SelTab parameter to QVadmin.aspx, the 2 CallBack parameter to QVgrid.aspx, or the 3 HelpPage parameter to commonhelp.aspx...
CorePlayer flash video player crossite scripting
Crossite scripting via callback parameter...
CVE-2012-4283
Cross-site scripting XSS vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
PT-2012-5311
Name of the Vulnerable Software and Affected Versions Login With Ajax plugin versions prior to 3.0.4.1 Description The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is achieved via the callback parameter...
CVE-2012-4283: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2012-2759
Cross-site scripting XSS vulnerability in login-with-ajax.php in the Login With Ajax aka login-with-ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter in a lostpassword action to wp-login.php...
CVE-2012-2759: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in login-with-ajax.php in the Login With Ajax aka login-with-ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter in a lostpassword action to wp-login.php...
CVE-2011-1714
Cross-site scripting XSS vulnerability in framework/source/resource/qx/test/jsonpprimitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in framework/source/resource/qx/test/jsonpprimitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2011-1714: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in framework/source/resource/qx/test/jsonpprimitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2008-6404
Cross-site scripting XSS vulnerability in addcalendars.php in eXtrovert Software Thyme 1.3 allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2008-6404: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in addcalendars.php in eXtrovert Software Thyme 1.3 allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2008-1318
Unspecified vulnerability in MediaWiki 1.11 before 1.11.2 allows remote attackers to obtain sensitive "cross-site" information via the callback parameter in an API call for JavaScript Object Notation JSON formatted results...
CVE-2008-1318: Exposure of Sensitive Information to an Unauthorized Actor
Unspecified vulnerability in MediaWiki 1.11 before 1.11.2 allows remote attackers to obtain sensitive "cross-site" information via the callback parameter in an API call for JavaScript Object Notation JSON formatted results...
MediaWiki JSON Callback Crafted API Request Information Disclosure
The version of MediaWiki installed on the remote host is affected by an information disclosure vulnerability. A remote attacker can exploit this via the 'callback' parameter in an API call for JavaScript Object Notation JSON formatted results. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
CVE-2007-5416
Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupaleval function through a callback parameter to t...