CVE-2013-4888

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

CVE-2013-4888

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

CVE-2013-4888

CVE-2013-4888 (Digital Signage Xibo 1.4.2) is a documented XSS in index.php via the layout parameter on the layout page; CVE-2013-4889 describes CSRF that can hijack admin actions (e.g., AddUser) and, as noted, can enable XSS through the same page. Exploitation details are present (e.g., CSRF exp...

CVE-2013-4888: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

PT-2014-2877

Name of the Vulnerable Software and Affected Versions Digital Signage Xibo version 1.4.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page. This could potentially lead to unauthorized...

CVE-2010-4278: Improper Neutralization of Special Elements used in an OS Command

operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php...

PT-2010-5396

Name of the Vulnerable Software and Affected Versions Pandora FMS versions prior to 3.1.1 Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an "operation/agentes/networkmap" action to "index.php"...

Directory traversal

Directory traversal vulnerability in index.php in SkaDate Dating allows remote attackers to read arbitrary files via a .. dot dot in the layout parameter...

CVE-2009-4700: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in SkaDate Dating allows remote attackers to read arbitrary files via a .. dot dot in the layout parameter...

CVE-2007-1445: Undefined Security Weakness

SQL injection vulnerability in the heme preview feature for default.asp in BP Blog 7.0 through 7.0.2 allows remote attackers to execute arbitrary SQL commands via the layout parameter...

CVE-2006-1679: Undefined Security Weakness

Cross-site scripting XSS vulnerability in modules/online.php in Jupiter CMS 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the layout parameter to index.php...