CVE-2012-6528

Multiple cross-site scripting XSS vulnerabilities in ATutor before 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 themes/default/tilesearch/index.tmpl.php, 2 login.php, 3 search.php, 4 passwordreminder.php, 5 login.php/jscripts/infusion, 6...

CVE-2012-6528

ATutor before 2.1 contains multiple cross-site scripting (XSS) vulnerabilities exploitable via PATH_INFO in several endpoints (themes/default/tile_search/index.tmpl.php, login.php, search.php, password_reminder.php, login.php/jscripts/infusion, login.php/mods/_standard/flowplayer, browse.php/jscr...

CVE-2012-6527

CVE-2012-6527 concerns the WordPress plugin My Calendar prior to version 1.10.2. The issue is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script or HTML via the PATH_INFO parameter. Multiple sources corroborate that versions before 1.10.2 are affect...

CVE-2011-5255: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin/login in X3 CMS 0.4.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, 2 username, or 3 password parameter...

CVE-2012-6527: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2012-6528: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ATutor before 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 themes/default/tilesearch/index.tmpl.php, 2 login.php, 3 search.php, 4 passwordreminder.php, 5 login.php/jscripts/infusion, 6...

CVE-2012-5874

Multiple SQL injection vulnerabilities in the 1 updatewhosonlinereg and 2 updatewhosonlineguest functions in Elite Bulletin Board before 2.1.22 allow remote attackers to execute arbitrary SQL commands via the PATHINFO to a checkuser.php, b groups.php, c index.php, d login.php, e quicklogin.php, f...

CVE-2012-5874: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the 1 updatewhosonlinereg and 2 updatewhosonlineguest functions in Elite Bulletin Board before 2.1.22 allow remote attackers to execute arbitrary SQL commands via the PATHINFO to a checkuser.php, b groups.php, c index.php, d login.php, e quicklogin.php, f...

CVE-2012-5666

Cross-site scripting XSS vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to apps/bookmark/index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to apps/bookmark/index.php...

CVE-2012-5666

Cross-site scripting XSS vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to apps/bookmark/index.php...

CVE-2012-5666: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to apps/bookmark/index.php...

CVE-2012-5969: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities on the Huawei E585 device allow remote attackers to 1 read arbitrary files via a .. dot dot in the PATHINFO of an sdcard/ request or 2 modify arbitrary files via a .. dot dot in the reqpage parameter to en/sms.cgi...

CVE-2012-2084

Cross-site scripting XSS vulnerability in the Printer, email and PDF versions module 6.x-1.x before 6.x-1.15 and 7.x-1.x before 7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably the PATHINFO...

CVE-2012-2084

Cross-site scripting XSS vulnerability in the Printer, email and PDF versions module 6.x-1.x before 6.x-1.15 and 7.x-1.x before 7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably the PATHINFO...

CVE-2012-2084: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Printer, email and PDF versions module 6.x-1.x before 6.x-1.15 and 7.x-1.x before 7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably the PATHINFO...

CVE-2012-5687: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlier allows remote attackers to read arbitrary files via a .. dot dot in the PATHINFO to the help/ URI...

CVE-2012-4532

Cross-site scripting XSS vulnerability in modules/modlanguages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php. NOTE: some of these details are obtained from third party...

CVE-2012-4532: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in modules/modlanguages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php. NOTE: some of these details are obtained from third party...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php, 2 modules/admin/adminmoduleindex.php, or 3 modules/calendar/customisecalendartimes.php; login parameter to 4 index.ph...