CVE-2008-2987: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Benja CMS 0.1 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 admineditsubmenu.php, 2 adminnewsubmenu.php, and 3 adminedittopmenu.php in admin/...

CVE-2008-2783

Multiple cross-site scripting XSS vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow remote attackers to inject arbitrary web script or HTML via the timestamp parameter to 1 week.php, 2 workweek.php, and 3 day.php; and 4 the horde parameter in the PATHINFO to the...

CVE-2008-2783: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow remote attackers to inject arbitrary web script or HTML via the timestamp parameter to 1 week.php, 2 workweek.php, and 3 day.php; and 4 the horde parameter in the PATHINFO to the...

CVE-2008-2561

Multiple cross-site scripting XSS vulnerabilities in 427BB 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to a register.php, b reminder.php, and c search.php; the 2 uname, 3 email, and 4 email2 parameters to register.php; the 5 email parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in 427BB 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to a register.php, b reminder.php, and c search.php; the 2 uname, 3 email, and 4 email2 parameters to register.php; the 5 email parameter to...

CVE-2008-2561

The CVE-2008-2561 entry documents multiple cross-site scripting (XSS) vulnerabilities in 427BB version 2.3.1. The flaws allow remote attackers to inject arbitrary script/HTML via these vectors: PATH_INFO to register.php, reminder.php, and search.php; the uname, email, and email2 parameters to reg...

CVE-2008-2561: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 427BB 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to a register.php, b reminder.php, and c search.php; the 2 uname, 3 email, and 4 email2 parameters to register.php; the 5 email parameter to...

CVE-2008-2496

Multiple cross-site scripting XSS vulnerabilities in Quate CMS 0.3.4 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php, 2 login.php, and 3 credits.php in admin/, and 4 upgrade/index.php...

CVE-2008-2496: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Quate CMS 0.3.4 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php, 2 login.php, and 3 credits.php in admin/, and 4 upgrade/index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web GUI in SAP Web Application Server WAS 7.0, Web Dynpro for ABAP aka WD4A or WDA, and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under bc/gui/sap/its/webgui/...

CVE-2008-2421: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web GUI in SAP Web Application Server WAS 7.0, Web Dynpro for ABAP aka WD4A or WDA, and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under bc/gui/sap/its/webgui/...

CVE-2008-2146

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...

CVE-2008-2146

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...

CVE-2008-2146: Undefined Security Weakness

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BolinOS 4.6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 url parameter to a system/actionspages/b/contentFiles/gBImageViewer.php, 2 ForEditor parameter to b system/actionspages/b/contentFiles/gBselectorContents.php,...

CVE-2008-1556

Multiple cross-site scripting XSS vulnerabilities in BolinOS 4.6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 url parameter to a system/actionspages/b/contentFiles/gBImageViewer.php, 2 ForEditor parameter to b system/actionspages/b/contentFiles/gBselectorContents.php,...

CVE-2008-1347

Multiple cross-site scripting XSS vulnerabilities in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 the q parameter in an about action to the help system...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 the q parameter in an about action to the help system...

CVE-2008-1347: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO or 2 the q parameter in an about action to the help system...

Authentication flaw

cgi/b on the BT Home Hub router allows remote attackers to bypass authentication, and read or modify administrative settings or make arbitrary VoIP telephone calls, by placing a character at the end of the PATHINFO, as demonstrated by 1 %5C encoded backslash, 2 '%' percent, and 3 '' tilde. NOTE:...