myBloggie 2.1.5 login.php PATH_INFO Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/22097/info MyBloggie is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

myBloggie 2.1.5 index.php PATH_INFO Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/22097/info MyBloggie is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

CVE-2011-4367: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces JSF in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. dot dot in the 1 ln parameter to faces/javax.faces.resource/web.xml or 2 the PATHINFO to...

CVE-2014-4301

Multiple cross-site scripting XSS vulnerabilities in the responderror function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 resources.js or 2 resources.css in ajenti:static/, related to the traceback page...

PYSEC-2014-99

Multiple cross-site scripting XSS vulnerabilities in the responderror function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 resources.js or 2 resources.css in ajenti:static/, related to the traceback page...

CVE-2014-4301

Ajenti (Eugene Pankov) before v1.2.21.7 contains XSS in respond_error() in routing.py, exploitable via PATH_INFO to resources.js or resources.css under ajenti:static/, as described in multiple sources (e.g., GHSA-2CH8-F849-PJG3). Root cause: unvalidated PATH_INFO leads to injection of arbitrary w...

CVE-2014-4301: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the responderror function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 resources.js or 2 resources.css in ajenti:static/, related to the traceback page...

CVE-2014-2577: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Transform Content Center in Bottomline Technologies Transform Foundation Server before 4.3.1 Patch 8 and 5.x before 5.2 Patch 7 allow remote attackers to inject arbitrary web script or HTML via the 1 pn parameter to index.fsp/document.pdf, ...

CVE-2014-2689

Cross-site scripting XSS vulnerability in Offiria 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to installer/index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Offiria 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to installer/index.php...

CVE-2014-2689

Cross-site scripting XSS vulnerability in Offiria 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to installer/index.php...

CVE-2014-3207

Cross-site scripting XSS vulnerability in wserver.ml in SKS Keyserver before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to pks/lookup/undefined1...

CVE-2014-2689

Offiria (vendor Slashes & Dots Sdn Bhd) 2.1.0 and earlier is affected by a reflected XSS via PATH_INFO to /installer/index.php. The vulnerability arises from insufficient sanitisation of user-supplied data in the URI, enabling remote script/HTML execution in the victim’s browser. CVSSv2 base scor...

CVE-2014-3207

CVE-2014-3207 is an XSS vulnerability in SKS Keyserver (wserver.ml) exploitable via PATH_INFO to pks/lookup/undefined1, affecting SKS before v1.1.5. Connected documents confirm the affected package SKS (Fedora 19/20) and indicate a vendor fix upgrading to 1.1.5. The Fedora advisories (FEDORA-2014...

CVE-2014-3207: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wserver.ml in SKS Keyserver before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to pks/lookup/undefined1...

CVE-2014-2689: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Offiria 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to installer/index.php...

CVE-2014-3138

SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATHINFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of the...

Sql injection

SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATHINFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of the...

CVE-2014-3138: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATHINFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of the...

CVE-2014-3138

CVE-2014-3138 describes an SQL injection in Xerox DocuShare. The vulnerability affects DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3, allowing remote authenticated users to execute arbitrary SQL commands via PATH_INFO to /docushare/dsw...