Cross site scripting

Cross-site scripting XSS vulnerability in json.php in French National Commission on Informatics and Liberty aka CNIL CookieViz allows remote we servers to inject arbitrary web script or HTML via the maxdate parameter...

Sql injection

SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty aka CNIL CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter...

CVE-2014-8351

SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty aka CNIL CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web UI before 2.3.4 Build 85 for Tenable Nessus 5.x allows remote web servers to inject arbitrary web script or HTML via the server header...

CVE-2014-7280

Cross-site scripting XSS vulnerability in the Web UI before 2.3.4 Build 85 for Tenable Nessus 5.x allows remote web servers to inject arbitrary web script or HTML via the server header...

Cross site scripting

Cross-site scripting XSS vulnerability in HP Records Manager before 7.3.5 and 8.x before 8.1 Patch 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-5338

Multiple cross-site scripting XSS vulnerabilities in the multisite component in CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the 1 renderstatusicons function in htmllib.py or 2 ajaxaction functio...

Splunk Enterprise 4.3.x / 5.0.x < 5.0.9 / 6.0.x < 6.0.5 / 6.1.x < 6.1.2 Multiple OpenSSL Vulnerabilities

According to its version number, the Splunk Enterprise hosted on the remote web server is 4.3.x, 5.0.x prior to 5.0.9, 6.0.x prior to 6.0.5, or 6.1.x prior to 6.1.2. It is, therefore, affected by multiple OpenSSL-related vulnerabilities : - An unspecified error exists that allows an attacker to...

SGI InfoSearch 1.0,SGI IRIX 6.5.x fname Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1031/info The InfoSearch package converts man pages and other documentation into HTML web content. The search form uses infosrch.cgi which does not properly parse user input in the 'fname' variable, allowing commands to b...

Kukol E.V. HTTP & FTP Server Suite 6.2 File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8564/info The web server component of Kukol E.V. HTTP & FTP Server Suite is prone to a file disclosure vulnerability. Remote web users may use directory traversal sequences in requests to gain access to files outside of t...

Galacticomm Worldgroup 3.20 Remote Web Server Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4186/info Galacticomm Worldgroup is a community building package of both client and server software for Microsoft Windows. Worldgroup is based on BBS software, and includes web and ftp servers. A vulnerability has been...

OSSIM tele_compress.php Directory Traversal

The OSSIM install hosted on the remote host has a directory traversal vulnerability. Input to the 'timestamp' parameter of the '/ossim/ocsreports/telecompress.php' script is not properly sanitized. A remote attacker could exploit this to download arbitrary files, subject to the privileges under...

Splunk < 5.0.6 Unspecified XSS

According to its version number, the Splunk Web hosted on the remote web server is affected by an unspecified cross-site scripting vulnerability. An attacker can exploit this issue to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the...

CVE-2013-6628

net/socket/sslclientsocketnss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by...

CVE-2013-6628

net/socket/sslclientsocketnss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by...

CVE-2013-5167

CFNetwork in Apple Mac OS X before 10.9 does not properly support Safari's deletion of session cookies in response to a reset operation, which makes it easier for remote web servers to track users via Set-Cookie HTTP headers...

Apache Struts 2 'action:' Parameter Prefix Security Constraint Bypass

The remote web application appears to use Struts 2, a web framework used for creating Java web applications. The version of Struts 2 in use is affected by a security constraint bypass vulnerability due to a flaw in the action mapping mechanism. Under certain unspecified conditions, an attacker...

Cacti < 0.8.8b Command and SQL Injections

Binary data 8004.prm...

BigTree CMS index.php SQL Injection

The BigTree CMS install hosted on the remote web server fails to sanitize user-supplied input to the application's 'site/index.php' script before using it in a database query. An unauthenticated attacker may be able to exploit this issue to manipulate database queries, leading to disclosure of...

Gallery 3.0.x < 3.0.8 Multiple XSS

According to its version number, the Gallery install hosted on the remote web server contains cross-site scripting vulnerabilities in the 'uploadify.swf' and 'flowplay.swf' files, where URL fragments and parameters are not properly sanitized when called via direct requests. An attacker may be abl...