CVE-2012-4928

The vulnerability is an XSS in Oxwall 1.1.1, specifically in the file ow_updates/index.php . It allows remote attackers to inject arbitrary web script or HTML through the plugin parameter. The issue arises from improper handling of user-supplied input in this script, leading to potential script e...

PT-2012-5663

Name of the Vulnerable Software and Affected Versions Oxwall version 1.1.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the plugin parameter in the ow updates/index.php file...

PT-2012-5662

Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 1.91+ Build 120224 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the fieldnames parameter to the "index.php" endpoint. Recommendations For versions prior to...

CVE-2012-4927: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Limesurvey a.k.a PHPSurveyor before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php...

CVE-2012-4336: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in Flogr 2.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 an arbitrary parameter...

CVE-2012-4928: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in owupdates/index.php in Oxwall 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the plugin parameter...

PT-2012-3086

Name of the Vulnerable Software and Affected Versions Open-Realty CMS versions 2.5.8 and earlier Description A directory traversal issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the select users template parameter to the...

CVE-2012-4870: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 context parameter to panel/indexamp.php or 2 panel/dhtml/index.php; 3 clid or 4 clidname parameters to panel/flash/mypage.php; 5 PATHINFO to...

CVE-2012-1112: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the selectuserstemplate parameter to index.php...

CVE-2012-1469: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the 1 editor or 2 callback parameters to lib/pkp/lib/tinymce/jscripts/tinymce/plugins/ibrowser/ibrowser.php in th...

PT-2012-3294

Name of the Vulnerable Software and Affected Versions Open Journal Systems versions prior to 2.3.7 Description The issue allows remote attackers and remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the editor or callback parameters to...

CVE-2012-4392

index.php in ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value...

CVE-2012-4392

index.php in ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value...

CVE-2012-4392

The vulnerability CVE-2012-4392 affects ownCloud Server versions earlier than 4.0.7, where index.php fails to properly validate the oc_token cookie, enabling remote attackers to bypass authentication with a crafted cookie. Multiple connected sources corroborate the authentication bypass issue and...

CVE-2012-4395

Cross-site scripting XSS vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirecturl parameter...

PT-2012-5366

Name of the Vulnerable Software and Affected Versions ownCloud version 4.0.7 Description The issue concerns improper validation of the oc token cookie in the index.php file, allowing remote attackers to bypass authentication by crafting a specific oc token cookie value. Recommendations For ownClo...

CVE-2012-4395: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirecturl parameter...

PT-2012-5369

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.3 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the redirect url parameter in the index.php...

CVE-2012-4392: Improper Authentication

index.php in ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value...

PT-2012-3383

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions prior to 1.5.20 Description The issue allows remote attackers to obtain sensitive information via various invalid parameters to different scripts, which reveals the installation path in an error message. This...