3058 matches found
CVE-2015-2939
Cross-site scripting XSS vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace...
CVE-2015-2938
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file...
CVE-2015-2932
Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element...
Design/Logic Flaw
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xmlparse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file...
UBUNTU-CVE-2015-2934
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xmlparse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file...
KLA10537 Multiple vulnerabilities in CA Spectrum
Multiple serious vulnerabilities have been found in CA Spectrum. Malicious users can exploit these vulnerabilities to gain privileges or inject arbitrary code. Below is a complete list of vulnerabilities 1. Improper data serialization can be exploited remotely via a specially designed Java object...
CVE-2015-2165
CVE-2015-2165 covers multiple stored/reflected XSS flaws in Ericsson Drutt MSDP Report Viewer (versions 4.x–6.x). The vulnerabilities allow remote attackers to inject arbitrary script/HTML via a large set of parameters across various JSP pages (top-links.jsp, page-summary.jsp, service-summary.jsp...
Code injection
The OLE Point of Sale OPOS drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSCashDrawer.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt...
vBulletin 4.x.x visitormessage.php Remote Code Injection Vulnerability
you can get access from vbulletin forum, just inject php code in one file. + My Homepage: black-hg.org / nasirpour.info + Discovered By: Dariush Nasirpour Net.Edit0r + Greeting : Ali Razmjoo - Ehsan Nezami - Arash Shams - Ramin Shahkar and all my freinds bhg...
vBulletin vBSEO 4.x - visitormessage.php Remote Code Injection
vBulletin vBSEO 4.x - visitormessage.php Remote Code Injection + Exploit Title: vBulletin 4.x.x 'visitormessage.php' Remote Code Injection Vulnerability + Discovered By: Dariush Nasirpour Net.Edit0r + My Homepage: black-hg.org / nasirpour.info + Date: 2015 27 February + Vendor Homepage:...
vBulletin vBSEO 4.x - 'visitormessage.php' Remote Code Injection
Exploit Title: vBulletin 4.x.x 'visitormessage.php' Remote Code Injection Vulnerability + Discovered By: Dariush Nasirpour Net.Edit0r + My Homepage: black-hg.org / nasirpour.info + Date: 2015 27 February + Vendor Homepage: vBulletin.com + Tested on: vBulletin 4.2.2 + Greeting : Ali Razmjoo -...
vBulletin 4.2.2 Remote Code Injection
Exploit Title: vBulletin 4.x.x 'visitormessage.php' Remote Code Injection Vulnerability + Discovered By: Dariush Nasirpour Net.Edit0r + My Homepage: black-hg.org / nasirpour.info + Date: 2015 27 February + Vendor Homepage: vBulletin.com + Tested on: vBulletin 4.2.2 + Greeting : Ali Razmjoo -...
CVE-2015-2088
Cross-site scripting XSS vulnerability in unspecified administration pages in the Term Queue module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unknown vectors...
CVE-2014-9685
Summary: CVE-2014-9685 concerns multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums. Affected versions are prior to 2.0.18.13 and 2.1.x prior to 2.1.1. The bugs allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. The documented impact is user-v...
CVE-2015-0167
textAngular-sanitize.js in the textAngular editor is vulnerable to cross-site scripting (XSS) in versions before 1.3.7. The vulnerability allows remote attackers to inject arbitrary script/HTML via unspecified vectors to the editor. Root cause details are described in the CVE record and CNVD/CVE ...
CVE-2014-8909
CVE-2014-8909 is an XSS vulnerability in IBM WebSphere Portal. Improper validation of user-supplied input allows remote authenticated users to inject arbitrary script or HTML via a crafted URL. Affected versions listed in the sources include WebSphere Portal 6.1.0.x (up to 6.1.0.6 CF27), 6.1.5.x ...
BlinkSale Script Insertion
Document Title: =============== BlinkSale Bug Bounty 1 - Encode & Validation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1416 Release Date: ============= 2015-02-06 Vulnerability Laboratory ID VL-ID: ====================================...
CVE-2015-0072
Cross-site scripting XSS vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a...
PT-2015-3090 · Sap · Sap Hana
Name of the Vulnerable Software and Affected Versions: SAP HANA affected versions not specified Description: The issue is related to incorrect code generation management in the SAP HANA database management system. It allows a remote attacker to inject arbitrary ABAP code. The Extended Application...