CMS Subkarma Cross Site Scripting / SQL Injection

Multiple SQL Injection & XSS on CMS SUBKARMA Risk: High CWE number: CWE-89,CWE-79 Date: 13/10/2014 Vendor: www.jttel.com.tw Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on: Linux Mint ; Firefox ; Sqlmap 1.0-dev-nongit-20140906 Vulnerables File: news.php ; product.php ;...

CVE-2014-4312

Multiple cross-site scripting XSS vulnerabilities in Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the 1 Notes section to Order details; 2 Description section to "Order to consume"; 3 Favorites name section to Favorites; 4...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the 1 Notes section to Order details; 2 Description section to "Order to consume"; 3 Favorites name section to Favorites; 4...

CVE-2014-4312

Multiple cross-site scripting XSS vulnerabilities in Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the 1 Notes section to Order details; 2 Description section to "Order to consume"; 3 Favorites name section to Favorites; 4...

Cross site scripting

Cross-site scripting XSS vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-4661

CVE-2014-4661: HP Records Manager is affected by a remote XSS in HP Records Manager 7.3.5 and 8.x up to 8.1 Patch 3. HP notes that HP Records Manager v8.1 Patch 3 and v7.3.5 (and earlier) are impacted; the vulnerability allows remote injection of script/HTML via unspecified vectors. Remediation p...

CVE-2014-8076

Cross-site scripting XSS vulnerability in the Professional theme 7.x before 7.x-2.04 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to custom copyright information...

CVE-2014-8078

Cross-site scripting XSS vulnerability in the Print aka Printer, e-mail and PDF versions module 6.x-1.x before 6.x-1.19, 7.x-1.x before 7.x-1.3, and 7.x-2.x before 7.x-2.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors...

CVE-2014-7982

Cross-site scripting XSS vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-7980

Multiple cross-site scripting XSS vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skiplinktext setting and unspecified...

CVE-2014-7978

Cross-site scripting XSS vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...

CVE-2014-4510

Cross-site scripting XSS vulnerability in job.cc in apt-cacher-ng 0.7.26 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in HP Systems Insight Manager SIM before 7.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

ZyXEL SBG-3300 Security Gateway Cross Site Scripting Vulnerability

ZyXEL SBG-3300 Security Gateway suffers from a cross site scripting vulnerability. Vulnerability Title: Stored Server XSS in ZyXEL SBG-3300 Security Gateway Date: 02/10/2014 CVE-ID: CVE-2014-7277 Product: ZyXEL SBG3300-N series Vendor: www.zyxel.com Affected Firmware: Latest version at the time o...

CVE-2014-6291

Cross-site scripting XSS vulnerability in the Alphabetic Sitemap alphasitemap extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-7157

Cross-site scripting XSS vulnerability in Exinda WAN Optimization Suite 7.0.0 2160 allows remote attackers to inject arbitrary web script or HTML via the tabsel parameter to admin/launch...

Cross site scripting

Cross-site scripting XSS vulnerability in Your Online Shop allows remote attackers to inject arbitrary web script or HTML via the productsid parameter...

CVE-2014-6619

Multiple cross-site scripting XSS vulnerabilities in register-exec.php in Restaurant Script PizzaInnProject 1.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 fname, 2 lname, or 3 login parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in safehtml.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5502

Cross-site scripting XSS vulnerability in safehtml.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors...