CVE-2014-6280

Multiple cross-site scripting XSS vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 action or 2 nsextt parameter to oc-admin/index.php or the 3 nsextt parameter in an itemsreported action to oc-admin/index.php...

CVE-2014-6308

Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter in a render action to oc-admin/index.php...

PT-2014-7129

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 3.4.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the action or nsextt parameter to "oc-admin/index.php" or the nsextt parameter in an "items reported...

CVE-2014-6280: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 action or 2 nsextt parameter to oc-admin/index.php or the 3 nsextt parameter in an itemsreported action to oc-admin/index.php...

CVE-2014-6308: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter in a render action to oc-admin/index.php...