Cross site scripting

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-2670: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-0344: Undefined Security Weakness

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

php-font-lib 'name'参数跨站脚本漏洞

Bugtraq ID:66380 CVE ID:CVE-2014-2570 php-font-lib是一款读取，解析，导出不同字体类型文件的PHP库。 通过"name" GET参数传递给www/makesubset.php的输入在返回用户之前缺少过滤，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可获取敏感信息或劫持用户会话。 0 php-font-lib 0.x php-font-lib 0.3.1已经修复该漏洞，建议用户下载更新： https://github.com/PhenX/php-font-lib...

CVE-2013-5714: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 message parameter. NOTE: some of these details are...

PT-2013-5746

Name of the Vulnerable Software and Affected Versions VideoWhisper Live Streaming Integration plugin versions 4.25.3 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the name or message parameter in the ls/htmlchat.php file. This can lead to...

CVE-2013-3598: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attackers to overwrite arbitrary files via a .. dot dot in the name parameter...

CVE-2013-5319: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in secure/admin/user/views/deleteuserconfirm.jsp in the Admin Panel in Atlassian JIRA before 6.0.5 allows remote attackers to inject arbitrary web script or HTML via the name parameter to secure/admin/user/DeleteUser!default.jspa...

CVE-2013-4951: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Mintboard 0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 pass parameter in views/login.php or 3 name or 4 pass parameter in views/signup.php...

CVE-2011-5203: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in WB/Default.asp in Akiva WebBoard before 8 SR 1 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information...

CVE-2012-1188: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the 1 type or 2 querystring parameters to private/en/error or 3 name parameter to private/en/locale/index...

Sql injection

Multiple SQL injection vulnerabilities in sign.php in tinyguestbook allow remote attackers to execute arbitrary SQL commands via the 1 name and 2 msg parameters. NOTE: some of these details are obtained from third party information...

CVE-2011-5201: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in sign.php in tinyguestbook allow remote attackers to execute arbitrary SQL commands via the 1 name and 2 msg parameters. NOTE: some of these details are obtained from third party information...

CVE-2012-1632: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in passwordpolicy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote authenticated users with administer policies permissions to inject arbitrary web script or HTML via the name parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in postalert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter...

CVE-2011-5107

Cross-site scripting XSS vulnerability in postalert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter...

CVE-2011-5107: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in postalert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter...

KindEditor 4.1.2 (name parameter) Reflected XSS Vulnerability

Summary KindEditor online HTML editor is a set of open source, mainly for users on the site to get WYSIWYG editing effects, developers can replace the traditional multi-line text input box textarea KindEditor rich visualization text input box. Description KindEditor is prone to a reflected...

CVE-2012-4267: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in user/register in Sockso 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter...

PT-2012-5295 · Sockso · Sockso

Name of the Vulnerable Software and Affected Versions: Sockso versions 1.5 and earlier Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the name parameter in the "user/register" endpoint. Recommendations: For Sockso versions 1.5 and...