CVE-2014-1695

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email...

CVE-2014-0081

Multiple cross-site scripting XSS vulnerabilities in actionview/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the 1 format, 2 negativeformat, or 3 units...

CVE-2013-7316

Cross-site scripting XSS vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML file, as demonstrated by README.html...

EUVD-2013-5847

Cross-site scripting XSS vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element...

CVE-2013-6923

The CVE-2013-6923 issue affects Seagate BlackArmor NAS sg2000-2000 with firmware sg2000-2000.1331. It describes two persistent XSS risks: (1) fullname input in admin/access_control_user_edit.php and (2) workname input in admin/network_workgroup_domain.php. The root cause is failure to sanitize us...

CVE-2013-7277

Andy’s PHP Knowledgebase (Aphpkb) is affected by CVE-2013-7277 via multiple XSS vectors in versions before 0.95.8: (1) HTTP Referer header to saa.php, (2) username parameter to login.php, and (3) keyword_list parameter to keysearch.php. The underlying issue enables a remote attacker to inject arb...

CVE-2013-5573

Cross-site scripting XSS vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration...

PT-2014-79: Cross-Site Scripting in ShopOS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in ShopOS. Cross-site scripting in the market.php script allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to fix No...

CVE-2013-7077

CVE-2013-7077 is a TYPO3 Backend User Administration Module cross-site scripting (XSS) vulnerability affecting TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Remediation per TYPO3 core advisory TY...

CVE-2013-7191

CVE-2013-7191 has a documented XSS vulnerability in Tenmiles Helpdesk Pilot. The issue arises when an attacker can inject arbitrary web script or HTML via the PATH_INFO to the default URI for a ticket. The available sources (NVD, CVE records) confirm the vulnerability and describe the impact as e...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Maximo Asset Management, Maximo Asset Management Essentials, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities 7.1.x through 7.1.1.12, 7.1.2, 7.5 befo...

Cross site scripting

Cross-site scripting XSS vulnerability in the numbertocurrency helper in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter...

Eaton Network Shutdown Module 3.21 - Remote PHP Code Injection

Eaton Network Shutdown Module 3.21 - Remote PHP Code Injection !/usr/bin/env python Quick 'n' Dirty - Metasploit module didn't do it for me 2013 - Filip Waeytens - http://www.wsec.be Usage Example: $ python eaton.py 192.168.1.9 "net user" User accounts for \...

Thomson Reuters Velocity Analytics - Remote Code Injection

Thomson Reuters Velocity Analytics - Remote Code Injection source: https://www.securityfocus.com/bid/63880/info Thomson Reuters Velocity Analytics is prone to a vulnerability that lets attackers inject and execute arbitrary code. Successfully exploiting this issue may allow an attacker to upload...

Thomson Reuters Velocity Analytics - Remote Code Injection

source: https://www.securityfocus.com/bid/63880/info Thomson Reuters Velocity Analytics is prone to a vulnerability that lets attackers inject and execute arbitrary code. Successfully exploiting this issue may allow an attacker to upload and execute arbitrary code with SYSTEM privileges. Thomson...

Cross site scripting

Cross-site scripting XSS vulnerability in the modpagespeed module 0.x, 1.0.22.7, 1.1.x, 1.24.1, 1.3.25.1 through 1.3.25.4, 1.4.26.1 through 1.4.26.4, 1.5.27.1 through 1.5.27.3, and 1.6.29.1 through 1.6.29.6 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML...

Joomla Maian15 Shell Upload

=================================================================================== / | | | / | | | | | | | | | | |/ | ' | / \ ' \ / |/ \ '/ | | | | '/ \ \ /\ / / | || | | | | | | || / | | | | | / | \ \ | || | | /\ V V / |,|| ||\|| ||, ||| |/ || | // / | |/...

CVE-2013-5210 Adtran Netvanta Remote Code Injection via XSS

Multiple Vulnerabilities in the Adtran Netvanta 7100 Impact: Multiple Local and Remote Compromise, XSS and other Injection Attacks Versions: firmware prior to R10.5.3.HA Author: J. Oquendo joquendo at e-fensive dot net I. ADVISORY Title: Multiple Vulnerabilities in Adtran Netvanta 7100 Date...

Cross site scripting

Cross-site scripting XSS vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/editor...

CVE-2013-5918

The CVE-2013-5918 entry affects the WordPress plugin Platinum SEO , specifically the file platinum_seo_pack.php in versions before 1.3.8 . The vulnerability is a reflected XSS via the s parameter, allowing remote attackers to inject arbitrary script/HTML. Impact is described as potentially exposi...