Dokeos LMS <= 1.8.5 (whoisonline.php) PHP Code Injection Exploit

Exploit for unknown platform in category web applications ================================================================ Dokeos LMS = 1.8.5 whoisonline.php PHP Code Injection Exploit ================================================================ ?php /...

phpMyAdmin 2.11.x < 2.11.9.4 / 3.0.x < 3.1.3 Multiple Vulnerabilities

phpMyAdmin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyadmin:phpmyadmin";...

DEBIAN-CVE-2009-1285

Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files...

CVE-2009-1285

Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco Subscriber Edge Services Manager SESM allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: some of these details are obtained from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allow remote attackers to inject arbitrary web script or HTML via 1 the fmt-out parameter to login.wcap or 2 the date...

DEBIAN-CVE-2009-1151

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action...

CVE-2009-1150

Multiple cross-site scripting XSS vulnerabilities in the export page displayexport.lib.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pmadbfilenametemplate cookie...

CVE-2008-6515

CVE-2008-6515 describes a cross-site scripting (XSS) vulnerability in Fritz Berger’s yet another php photo album - next generation (yappa-ng). The issue allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI. The available records identify the affec...

SOL9875 - BIG-IP management interface vulnerability CVE-2008-6474

The BIG-IP CLI and Web Management Interface are vulnerable to a remote code-injection because the application fails to properly sanitize user-supplied input. Exploiting this issue may allow an attacker to execute arbitrary code with the privileges of the user running the affected application...

Cross site scripting

Cross-site scripting XSS vulnerability in Adobe RoboHelp 6 and 7, and RoboHelp Server 6 and 7, allows remote attackers to inject arbitrary web script or HTML via vectors involving files produced by RoboHelp...

CVE-2009-0540

Libero CVE-2009-0540 is an XSS vulnerability in Libero 5.3 SP5 (and possibly versions before 5.5 SP1) that allows remote attackers to inject arbitrary web script via the search term field. The issue arises from insufficient input filtering/sanitisation of HTML tags in the web app, and is categori...

ESET Remote Administrator远程脚本注入漏洞

BUGTRAQ ID: 33633 CVECAN ID: CVE-2009-0548 ESET Remote Administrator用于远程安装和集中管理网络中的ESET杀毒软件。 ESET Remote Administrator没有正确地验证对Additional Report Settings接口的输入，远程攻击者可以通过提交恶意请求注入任意HTML和脚本代码，并在用户查看报表的时候执行注入的代码。 Eset Remote Administrator 3.0.35 厂商补丁： Eset ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2008-6113

Cross-site scripting XSS vulnerability in SemanticScuttle before 0.90 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the 1 username and 2 profile page...

CVE-2009-0424

The CVE-2009-0424 entry concerns AN Guestbook (ANG) prior to version 0.7.7. The vulnerability is a Cross‑Site Scripting (XSS) in sign1.php where the country parameter is not properly sanitized, enabling an attacker to inject arbitrary script/HTML via affected paths (administrator/manage.php or ad...

CVE-2009-0273

CVE-2009-0273 affects Novell GroupWise WebAccess (versions 6.5x, 7.0/7.01/7.02x/7.03/7.03HP1a, and 8.0). The vulnerability stems from cross-site scripting via unsanitized input in the WebAccess component, notably the POST parameters User.id and Library.queryText to /gw/webacc, with additional vec...

CVE-2009-0275

CVE-2009-0275 affects Ryneezy phoSheezy 0.2 via a static code injection vulnerability in admin.php that lets an authenticated admin inject PHP into config/header (and related config/footer, header) and can be exploited via CVE-2009-0250 to facilitate unauthenticated access. The issue is documente...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to inject arbitrary web script or HTML via the cID parameter in a document action. NOTE: the provenance of this information is unknown; the details are obtained solely from thir...

CVE-2009-0260

CVE-2009-0260: Multiple XSS vulnerabilities in MoinMoin, via action/AttachFile.py for WikiSandBox in versions before 1.8.1; attackers can inject script/HTML through AttachFile parameters rename or drawing (basename). Remote exploitation possible; remediation is upgrading to MoinMoin 1.8.1 or late...

CVE-2008-5917

The CVE-2008-5917 entry describes a Cross-site scripting (XSS) vulnerability in Horde Application Framework’s Text_Filter/Filter/xss.php, affecting Horde 3.2.2 and 3.3. It is reported when using Internet Explorer, allowing remote attackers to inject arbitrary web script or HTML via unknown vector...