Cross site scripting

Cross-site scripting XSS vulnerability in the NewSectionPrompt function in include/tool/editingpage.php in gpEasy CMS 3.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the section parameter in a newsection action to index.php...

CVE-2013-0807: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the NewSectionPrompt function in include/tool/editingpage.php in gpEasy CMS 3.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the section parameter in a newsection action to index.php...

OXID eShop 'index.php'多个HTTP应答拆分漏洞

Bugtraq ID:66371 CVE ID:CVE-2014-2017 OXID eShop又名OXID eSales是一个e-commerce系统,采用PHP开发,使用MySQL来存储数据。 通过"anid", "cnid"和"listtype"参数传递给index.php的输入在用于限制HTTP头字段时缺少过滤，允许远程攻击者利用漏洞把包含任意HTTP头的应答发送给用户。 0 OXID eShop 4.x OXID eShop 5.x OXID eShop Professional, Community或Enterprise version 4.7.11/5.0.11 and...

CVE-2013-5953

Multiple cross-site scripting XSS vulnerabilities in tmpl/layouteditevent.php in the Multi Calendar commulticalendar component 4.0.2, and possibly 4.8.5 and earlier, for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 calid or 2 paletteDefault parameter in an...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in tmpl/layouteditevent.php in the Multi Calendar commulticalendar component 4.0.2, and possibly 4.8.5 and earlier, for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 calid or 2 paletteDefault parameter in an...

CVE-2013-5955: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manage.php in the PBBooking compbbooking component 2.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the an arbitrary parameter in an edit action to administrator/index.php...

PT-2014-3007

Name of the Vulnerable Software and Affected Versions com pbbooking version 2.4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating an arbitrary parameter in an edit action to...

Joomla Multi Calendar 4.0.2 Cross Site Scripting

Hello, Multiple cross-site scripting XSS vulnerabilities in Multi calendar 4.0.2 component for Joomla! allow remote attackers to inject arbitrary web script or HTML code via 1 the calid parameter to index.php or 2 the paletteDefault parameter to index.php. File: /tmpl/layouteditevent.php Lines: 1...

CVE-2013-2044

Open redirect vulnerability in the Login Page index.php in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

CVE-2013-2047

The login page aka index.php in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password...

CVE-2013-2085

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

CVE-2013-2085: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in apps/filestrashbin/index.php in ownCloud Server before 5.0.6 allows remote authenticated users to access arbitrary files via a .. dot dot in the dir parameter...

PT-2014-2545

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 5.0.6 Description The issue allows remote authenticated users to access arbitrary files. This is achieved by utilizing a .. dot dot in the dir parameter of the apps/files trashbin/index.php file, which enables...

CVE-2013-2044: Improper Input Validation

Open redirect vulnerability in the Login Page index.php in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

CVE-2013-2047: Undefined Security Weakness

The login page aka index.php in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password...

PT-2014-2537

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 5.0.6 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect url parameter in the Login Page index.php. Recommendations For...

ClanSphere "where"跨站脚本漏洞

ClanSphere是一个高级Web内容管理系统，主要用于搭建部落和电子竞技类网站。 由于通过"where" GET参数传递到index.php 当"mod"设置为"users"的输入在返回用户前没有正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 ClanSphere 2011.4.3 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.csphere.eu/...

CVE-2013-6037

Cross-site scripting XSS vulnerability in index.php in Aker Secure Mail Gateway 2.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the msgid parameter...

CVE-2013-6037: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Aker Secure Mail Gateway 2.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the msgid parameter...

PT-2014-2579

Name of the Vulnerable Software and Affected Versions Batavi version 1.2.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the QUERY STRING to "admin/index.php". This could potentially lead to unauthorized actions on the affected...