CVE-2013-7317

Multiple cross-site scripting XSS vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 settingsfile or 2 datafile parameter to a ampie.swf, b amline.swf, or c amcolumn.swf...

CVE-2013-7317

CVE-2013-7317 affects CS-Cart prior to 4.1.1 and involves cross-site scripting (XSS) via the vulnerable parameters settings_file and data_file to the SWF files ampie.swf, amline.swf, or amcolumn.swf. The issue allows remote attackers to inject arbitrary script/HTML in the context of the user’s br...

PT-2014-3359

Name of the Vulnerable Software and Affected Versions CS-Cart versions prior to 4.1.1 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the settings file or data file parameters to specific API endpoints, such as a "ampie.swf", b...

CVE-2013-7317: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 settingsfile or 2 datafile parameter to a ampie.swf, b amline.swf, or c amcolumn.swf...

CS-Cart version 4.0.2 contains cross-site scripting vulnerabilities

Overview CS-Cart version 4.0.2 and possibly earlier versions contain cross-site scripting XSS vulnerabilities CWE-79. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CS-Cart version 4.0.2 and possibly earlier versions contain cross-site...

Cisco Mars Cross-Site Scripting Vulnerability - CVE-2013-5563

Vulnerability Type: Cross-Site Scripting CVE: CVE-2013-5563 Products and affected versions: Cisco Security Monitoring, Analysis and Response System CS-MARS - All versions Vendor Website: http://www.cisco.com/en/US/products/ps6241/ Cisco Advisory: https://tools.cisco.com/bugsearch/bug/CSCul16173...

CVE-2013-5563

Cross-site scripting XSS vulnerability in Query/NewQueryResult.jsp in Cisco Security Monitoring, Analysis and Response System CS-MARS allows remote attackers to inject arbitrary web script or HTML via the isnowLatency parameter, aka Bug ID CSCul16173...

CVE-2013-5563

CVE-2013-5563 is a cross-site scripting (XSS) vulnerability in Cisco Security Monitoring, Analysis and Response System (CS-MARS). The issue arises because input passed to Query/NewQueryResult.jsp (notably the isnowLatency parameter) is not properly sanitized, allowing an attacker to inject arbitr...

PT-2013-5643

Name of the Vulnerable Software and Affected Versions Cisco Security Monitoring, Analysis and Response System CS-MARS affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the isnowLatency paramete...

Linkedin Social Network - CS Flash Cross Site Vulnerability

Document Title: =============== Linkedin Social Network - CS Flash Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1021 Release Date: ============= 2013-09-19 Vulnerability Laboratory ID VL-ID: ===================================...

PT-2013-4659

Name of the Vulnerable Software and Affected Versions Oracle Supply Chain Products Suite version 9.3.1 Description The issue affects the integrity of the system, allowing remote attackers to exploit it via unknown vectors related to the Web Client CS in the Oracle Agile PLM Framework component...

PT-2013-4610

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content versions 10.1.3.5.1, 11.1.1.6.0, and 11.1.1.7.0 Description The issue affects confidentiality and integrity, allowing remote authenticated users to exploit it via unknown vectors related to Content Server. There are...

CVE-2013-3822: Undefined Security Weakness

Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.1 allows remote attackers to affect integrity via unknown vectors related to Web Client CS...

Content Spoofing vulnerabilities in TinyMCE and WordPress

Hello 3APA3A! This are Content Spoofing vulnerabilities in TinyMCE and WordPress. Which I've disclosed on Wednesday. In 2011 I already wrote about Content Spoofing in Moxieplayer, when I wrote concerning multiple vulnerabilities in TinyMCE http://securityvulns.ru/docs27349.html, which is a...

CVE-2013-0118

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

Code injection

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2013-0118

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2013-0118

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2013-0118

CVE-2013-0118 affects CS-Cart prior to 3.0.6 where PayPal Standard Payments is configured. The vulnerability allows a remote attacker to change the payment recipient by sending a modified merchant email address, effectively setting the recipient to themselves. The NVD lists a base score of 5.0 (M...

CVE-2013-0118: Undefined Security Weakness

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...