CVE-2010-3274

Affected product/version: ManageEngine ADSelfService Plus (Zoho) prior to 4.5 Build 4500. Vulnerability type: Cross‑site scripting (XSS) in EmployeeSearch.cc, affecting the search functionality; exploits reflect user input back to the page. Impact/reason: Remote attackers can inject arbitrary scr...

CVE-2011-0446

Multiple cross-site scripting XSS vulnerabilities in the mailto helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted 1 name or 2 email value...

Smarty Template Engine 2.6.9 - '$smarty.template' PHP Code Injection

source: https://www.securityfocus.com/bid/46366/info Smarty Template Engine is prone to a remote PHP code-injection vulnerability. An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the webserver process. This may facilitate a compromise of the applicati...

CVE-2011-0526

CVE-2011-0526 is a documented XSS in Vanilla Forums prior to 2.0.17. An attacker could inject arbitrary script/HTML via the Target parameter in the /entry/signin action (index.php). The Red Hat and NVD entries confirm the affected product and vector, with no exploitation details provided in the s...

CVE-2010-4071

Cross-site scripting XSS vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail...

CVE-2011-0004

Multiple cross-site scripting XSS vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-4497

CVE-2010-4497 is an XSS vulnerability in the Collaborative Information Manager (CIM) server, as used in TIBCO CIM before 8.1.0 and ActiveCatalog before 1.0.1. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The available documents do not provide d...

CVE-2010-4524

Cross-site scripting XSS vulnerability in lib/mhtxthtml.pl in MHonArc 2.6.16 allows remote attackers to inject arbitrary web script or HTML via a malformed start tag and end tag for a SCRIPT element, as demonstrated by ipt and ipt sequences...

Gitweb <=1.7.3.3 Cross Site Scripting

Exploit for cgi platform in category web applications -8 Description 8--8 Proof Of Concept 8- " -8 Credits 8- -8 Responsible Disclosure 8- 13-12-2010 Initial contact with upstream and vendor-sec 13-12-2010 Vendor Response and CVE-2010-3906 assignation 15-12-2010 Public Disclosure 0day.today...

CVE-2010-4388

The 1 Upsell.htm, 2 Main.html, and 3 Custsupport.html components in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allow remote attackers to inject code into the RealOneActiveXObject process, and consequently bypass intended...

CVE-2010-4388

The 1 Upsell.htm, 2 Main.html, and 3 Custsupport.html components in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allow remote attackers to inject code into the RealOneActiveXObject process, and consequently bypass intended...

CVE-2010-4396

CVE-2010-4396 involves a Cross-zone scripting vulnerability in RealNetworks RealPlayer's ActiveX control (NavigateToURL path) affecting RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.5, and RealPlayer Enterprise 2.1.2. The HandleAction method can be exploited to inject arbitrary web script/HTML into...

CVE-2010-4388

The CVE-2010-4388 issue affects RealNetworks RealPlayer suites (RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.5, RealPlayer Enterprise 2.1.2–2.1.3). Concrete details in connected sources show a uniform vulnerability in the RealOneActiveXObject handling within Upsell.htm, Main.html, and Custsupport....

Pandora FMS 3.1 - Authentication Bypass

Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers, applications and hardware systems such as...

Pandora Fms 3.1 - SQL Injection

Pandora Fms 3.1 - SQL Injection + Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers, applications...

Pandora Fms 3.1 - SQL Injection

Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers, applications and hardware systems such as...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to inject arbitrary web script or HTML via the command parameter to the administration interface, as demonstrated by the command parameter to ESAdmin/collection.do...

RoSPORA 1.5.0 Remote PHP Code Injection

'; 671. $link=$SERVER'PHPSELF'."?f=".$flag."&s="; 672. 673. if !empty$plarray 674. 675. usort$plarray, createfunction'$a, $b', 'if $a'.$sort.' == $b'.$sort.' return 0; if $a'.$sort.' '.$sorttype.' $b'.$sort.' return -1; return 1;'; 676. Input parameter passed through $GET's' isn't properly...

腾讯QQ 2010 SP1消息记录远程代码注入漏洞

腾讯QQ是一款在中国非常广泛使用的即时聊天工具。 腾讯QQ 2010 SP1在处理消息记录时，没有对会话消息中的Javascript和Html标签进行正确转义，攻击者可以发送恶意消息注入脚本代码并执行。 Tencent QQ 2010 SP1 最新版本的腾讯QQ已经修复此漏洞，建议用户下载使用： http://im.qq.com/qq/dlqq.shtml input onclick="window.location=' x68x74x74x70x3ax2fx2fx77x77x77x2ex62x6fx77x6fx73x2ex63x6fx6d'"/ img src='tetet'...

CVE-2010-3715

Multiple cross-site scripting XSS vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the RemoveXSS function, and allow remote authenticated users to inject arbitrary web...