CVE-2013-5693

CVE-2013-5693 affects X2Engine X2CRM

CVE-2013-5693

Cross-site scripting XSS vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/editor...

PT-2013-5728

Name of the Vulnerable Software and Affected Versions X2Engine X2CRM versions prior to 3.5 Description A directory traversal issue allows remote authenticated administrators to include and execute arbitrary local files. This is achieved by using a .. dot dot in the file parameter to the...

CVE-2013-5693: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/editor...

PT-2013-5729

Name of the Vulnerable Software and Affected Versions X2Engine X2CRM versions prior to 3.5 Description The issue allows remote attackers to inject arbitrary web script or HTML via the model parameter to "index.php/admin/editor". This can lead to cross-site scripting XSS attacks. Recommendations F...

CVE-2013-4983: Improper Neutralization of Special Elements used in an OS Command

The getreferers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php...

PT-2013-5659

Name of the Vulnerable Software and Affected Versions Cacti versions 0.8.8b and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters. For example, the...

CVE-2013-5588: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the step parameter to install/index.php or 2 the id parameter to cacti/host.php...

Sql injection

SQL injection vulnerability in Ginkgo CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the rang parameter to index.php...

PT-2013-5478

Name of the Vulnerable Software and Affected Versions Ginkgo CMS version 5.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the rang parameter to the "index.php" endpoint. Recommendations For Ginkgo CMS version 5.0, avoid using the rang...

PT-2013-5477

Name of the Vulnerable Software and Affected Versions RiteCMS version 1.0.0 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the mode parameter to "cms/index.php". Recommendations For RiteCMS version 1.0.0, avoid using the...

CVE-2013-5318: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Ginkgo CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the rang parameter to index.php...

CVE-2013-5317: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in RiteCMS 1.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the mode parameter to cms/index.php...

CVE-2013-5321: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management OSSIM 4.1 allow remote attackers to execute arbitrary SQL commands via the 1 sensor parameter in a Query action to forensics/baseqrymain.php; the 2 tcpflags or 3 tcpport04 parameter to...

PT-2013-5476

Name of the Vulnerable Software and Affected Versions RiteCMS version 1.0.0 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that change the administrator password. This is done via an edit user action to...

PT-2013-5481

Name of the Vulnerable Software and Affected Versions AlienVault Open Source Security Information Management OSSIM version 4.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through various parameters in different PHP files, including the...

CVE-2013-5316: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via an edit user action to cms/index.php...

CVE-2013-4881

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php...

PT-2013-5258

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.0 RC2 and earlier Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to "index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in install/forumdata/src/customfields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these details are obtained from...