CVE-2012-5865

SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid parameter in a stats action...

CVE-2012-5865: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid parameter in a stats action...

PT-2014-2363

Name of the Vulnerable Software and Affected Versions Achievo version 1.4.5 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the activityid parameter in a "stats" action. The vulnerable endpoint is related to the dispatch.php file...

PT-2014-7137

Name of the Vulnerable Software and Affected Versions TYPO3 Statistics ke stats extension versions prior to 1.1.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This has been exploited in the wild. Recommendations For versions prior to 1.1.2, update to version...

kernel security and bug fix update

kernel 2.6.18-371.12.1.0.1 - ocfs2: dlm: fix recovery hung Junxiao Bi orabug 13956772 - i386: fix MTRR code Zhenzhong Duan orabug 15862649 - oprofile x86, mm: Add getuserpagesfast orabug 14277030 - oprofile export getuserpagesfast function orabug 14277030 - oprofile oprofile, x86: Fix nmi-unsafe...

CVE-2014-5456

Cross-site scripting XSS vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "Content Type: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration...

Cross site scripting

Cross-site scripting XSS vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "Content Type: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration...

CVE-2014-5456

Cross-site scripting XSS vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "Content Type: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration...

CVE-2014-5456

Cross-site scripting XSS vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "Content Type: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration...

CVE-2014-5456

CVE-2014-5456 relates to the Drupal Social Stats module for 7.x-1.x. The vulnerability is a persistent XSS caused by insufficient filtering of text stored in the module’s configuration, exploitable by remote authenticated users who have the "[Content Type]: Create new content" permission. Affecte...

PT-2014-6486

Name of the Vulnerable Software and Affected Versions Drupal Social Stats module versions prior to 7.x-1.5 Description The issue allows remote authenticated users with the "Content Type: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration...

CVE-2014-5456: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "Content Type: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration...

SA-CONTRIB-2014-080 - Social Stats - Cross Site Scripting (XSS)

The Social Stats module enables you to collect statistics from various social networks and use that data with the Views module as field data, sort criteria, or filter criteria. The module does not sufficiently filter user-supplied text that is stored in the configuration, resulting in a persisten...

CVE-2014-4511: Undefined Security Weakness

Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a 1 blame, 2 file, or 3 stats page, as demonstrated by requests to blame/master/, master/, and stats/master/...

PT-2014-5942

Name of the Vulnerable Software and Affected Versions Gitlist versions prior to 0.5.0 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a blame, file, or stats page. This can be demonstrated by request...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WP GuestMap plugin 1.8 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 zl, 2 mt, or 3 dc parameter to guest-locator.php; the 4 zl, 5 mt, 6 activate, or 7 dc parameter to online-tracker.php;...

PT-2014-6001

Name of the Vulnerable Software and Affected Versions WP GuestMap plugin version 1.8 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters in several PHP files. Specifically, the parameters zl, mt, and dc in "guest-locator.php",...

CVE-2014-4587: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the WP GuestMap plugin 1.8 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 zl, 2 mt, or 3 dc parameter to guest-locator.php; the 4 zl, 5 mt, 6 activate, or 7 dc parameter to online-tracker.php;...

Php-Stats <= 0.1.9.1b (php-stats-options.php) admin 2 exec() eExploit

No description provided by source. ?php printr' --------------------------------------------------------------------------- Php-Stats = 0.1.9.1b admin 2 exec exploit by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org dork example: inurl:php-stats.js.php...

Prozilla Top 100 1.2 - Arbitrary Delete Stats Vulnerability

No description provided by source. --==+================================================================================+==-- --==+ Prozilla Top 100 1.2 Arbitrary Delete Stats Vulnerability +==-- --==+================================================================================+==-- Discovered...