1201 matches found
PT-2013-5728
Name of the Vulnerable Software and Affected Versions X2Engine X2CRM versions prior to 3.5 Description A directory traversal issue allows remote authenticated administrators to include and execute arbitrary local files. This is achieved by using a .. dot dot in the file parameter to the...
UBUNTU-CVE-2013-5588
Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the step parameter to install/index.php or 2 the id parameter to cacti/host.php...
CVE-2013-0125
Cross-site scripting XSS vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter...
CVE-2013-0125
Cross-site scripting XSS vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter...
CVE-2013-0125: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter...
PT-2013-2112
Name of the Vulnerable Software and Affected Versions C2 WebResource affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the File parameter in the fileview.asp page. Recommendations At the moment...
Google Doc Embedder Plugin for WordPress 'File' Parameter Traversal Arbitrary File Disclosure
The Google Doc Embedder Plugin for WordPress installed on the remote host is affected by a file disclosure vulnerability due to a failure to properly sanitize user-supplied input to the 'file' parameter of the 'libs/pdf.php' script. This vulnerability could allow an unauthenticated, remote attack...
PT-2014-2287
Name of the Vulnerable Software and Affected Versions Google Doc Embedder plugin versions prior to 2.5.4 Description The issue allows remote attackers to read arbitrary files. This is achieved by using a .. dot dot in the file parameter to the "libs/pdf.php" endpoint. Recommendations For versions...
WebPagetest < 2.7.2 file Parameter Traversal Arbitrary File Access
The WebPagetest install hosted on the remote web server fails to sanitize user input to the 'file' parameter of the 'gettext.php' script of directory traversal sequences before using it to return the contents of a file. An unauthenticated, remote attacker can exploit this to view the contents of...
Design/Logic Flaw
Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type aka monitor type name parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter...
CVE-2012-4394
Cross-site scripting XSS vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter...
CVE-2012-4394
CVE-2012-4394 (ownCloud XSS) : A cross-site scripting vulnerability affects ownCloud before version 4.0.5. The issue is in the JS file apps/files/js/filelist.js, allowing remote attackers to inject arbitrary web script or HTML via the file parameter. Impact is reflected in the user’s browser sess...
PT-2012-4802
Name of the Vulnerable Software and Affected Versions Crowbar versions 1.4 and earlier Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the file parameter to the "/utils" API endpoint. Recommendations For Crowbar versions 1....
PT-2012-5368
Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.5 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the file parameter in the...
CVE-2012-3551: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in crowbarframework/app/views/support/index.html.haml in the Crowbar barclamp in Crowbar, possibly 1.4 and earlier, allows remote attackers to inject arbitrary web script or HTML via the file parameter to /utils...
CVE-2012-4394: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter...
PT-2012-1884
Name of the Vulnerable Software and Affected Versions WikkaWiki versions 1.3.1 through 1.3.2 Description The issue allows remote attackers to read or delete arbitrary files via a non-initial .. dot dot in the file parameter. This can be demonstrated by using the /../../wikka.config.php pathname i...
