MingSoft Mcms SQL注入漏洞

MingSoft Mcms is China's MingFei MingSoft company's a complete open source J2ee system . A security vulnerability exists in MingSoft Mcms v5.2.5 that allows an attacker to perform a SQL injection attack via the search.do parameter in the file /web/MCmsAction.java. No details of the vulnerability...

JBoss RichFaces vulnerable to remote Java code execution

Overview JBoss RichFaces contains a remote Java code execution vulnerability. JBoss RichFaces is an Ajax-enabled component library for JavaServer Faces JSF. JBoss RichFaces contains a flaw in parsing the do parameter, which may result in arbitrary Java code execution. Takeshi Terada of Mitsui...

CVE-2015-0279

JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language EL expressions and execute arbitrary Java code via the do parameter...

CVE-2015-0279: Improper Control of Generation of Code

JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language EL expressions and execute arbitrary Java code via the do parameter...

PT-2015-4559

Name of the Vulnerable Software and Affected Versions JBoss RichFaces versions prior to 4.5.4 Tufin SecureChange affected versions not specified Description The issue allows remote attackers to inject expression language EL expressions and execute arbitrary Java code. This can be achieved via the...

RichFaces: Remote Command Execution via insufficient EL parameter sanitization

It was found that the 'do' parameter permitted expression language EL injection, which could allow a remote attacker to execute Java methods on an affected server...

PT-2014-6090

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.9.2 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via several fields, including the Phone Number...

CVE-2012-1604: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in NextBBS 0.6 allows remote attackers to inject arbitrary web script or HTML via the do parameter to index.php...

PT-2012-3374

Name of the Vulnerable Software and Affected Versions NextBBS version 0.6 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the do parameter to index.php. Recommendations For NextBBS version 0.6, update to...

CVE-2008-3184

Multiple cross-site scripting XSS vulnerabilities in vBulletin 3.6.10 PL2 and earlier, and 3.7.2 and earlier 3.7.x versions, allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO PHPSELF or 2 the do parameter, as demonstrated by requests to upload/admincp/faq.php. NOTE:...

CVE-2008-3184: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in vBulletin 3.6.10 PL2 and earlier, and 3.7.2 and earlier 3.7.x versions, allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO PHPSELF or 2 the do parameter, as demonstrated by requests to upload/admincp/faq.php. NOTE:...

CVE-2007-4413: Undefined Security Weakness

Direct static code injection vulnerability in admincp/userhelp.php in Headstart Solutions DeskPRO 3.0.2 allows remote authenticated users to inject arbitrary PHP code into an unspecified file via a newentry value in the do parameter...

CVE-2007-2423: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in MoinMoin 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the do parameter in an AttachFile action, a different vulnerability than CVE-2007-0857. NOTE: the provenance of this information is unknown; the details are...

CVE-2006-2949

Cross-site scripting XSS vulnerability in private.php in MyBB 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the do parameter...

CVE-2006-2949: Undefined Security Weakness

Cross-site scripting XSS vulnerability in private.php in MyBB 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the do parameter...

CVE-2003-0980

CVE-2003-0980 is an XSS vulnerability in FreeScripts VisitorBook LE (visitorbook.pl). The issue permits remote attackers to inject arbitrary HTML or JavaScript via (1) the do parameter, (2) the user parameter from a host with a malicious reverse DNS name, and (3) quote marks or ampersands in othe...

CVE-2003-0980: Undefined Security Weakness

Cross-site scripting XSS vulnerability in FreeScripts VisitorBook LE visitorbook.pl allows remote attackers to inject arbitrary HTML or web script via 1 the "do" parameter, 2 via the "user" parameter from a host with a malicious reverse DNS name, 3 via quote marks or ampersands in other parameter...