PT-2021-22061

Name of the Vulnerable Software and Affected Versions WooCommerce Payment Gateway Per Category WordPress plugin versions up to and including 2.0.10 Description The issue is related to Reflected Cross-Site Scripting, which occurs due to a reflected $ SERVER"PHP SELF" value in the /includes/plugin...

PT-2014-2686

Name of the Vulnerable Software and Affected Versions OpenX versions prior to 2.8.10 revision 82710 Description The issue allows remote administrators to read arbitrary files via a .. dot dot in the group parameter to 1 "plugin-preferences.php" or 2 "plugin-settings.php" in www/admin. This can be...

PT-2014-3405

Name of the Vulnerable Software and Affected Versions OpenX versions 2.8.10 and possibly prior to revision 82710 Description The issue allows remote attackers to hijack the authentication of administrators. This can be achieved through requests that conduct directory traversal attacks via the gro...

CVE-2013-7376: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack the authentication of administrators, as demonstrated by requests that conduct directory traversal attacks via the group parameter to 1 plugin-preferences.php...

CVE-2013-3514: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. dot dot in the group parameter to 1 plugin-preferences.php or 2 plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376. NOTE: thi...

CVE-2013-3515

Multiple cross-site scripting XSS vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 package parameter to www/admin/plugin-index.php or the 2 group parameter to www/admin/plugin-settings.php...

CVE-2013-3515

Multiple cross-site scripting XSS vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 package parameter to www/admin/plugin-index.php or the 2 group parameter to www/admin/plugin-settings.php...

PT-2013-4449

Name of the Vulnerable Software and Affected Versions OpenX Source versions 2.8.10 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This is possible via the package parameter to...

CVE-2013-3515: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 package parameter to www/admin/plugin-index.php or the 2 group parameter to www/admin/plugin-settings.php...