8146 matches found
CVE-2014-2090: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tar, 2 tarval, or 3 title parameter...
PT-2014-4479
Name of the Vulnerable Software and Affected Versions ATutor version 2.1.1 Description A cross-site scripting XSS issue allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an 'add forum' action. This occurs in the mods/...
PT-2014-4478
Name of the Vulnerable Software and Affected Versions ILIAS version 4.4.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML. The vulnerable parameters are tar, tar val, an...
CVE-2014-0046
Cross-site scripting XSS vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute...
CVE-2014-0046
Cross-site scripting XSS vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute...
CVE-2014-2231
Cross-site scripting XSS vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property title...
PT-2014-3450
Name of the Vulnerable Software and Affected Versions Ember.js versions 1.2.x through 1.2.1 Ember.js versions 1.3.x through 1.3.1 Ember.js versions 1.4.x through 1.4.0-beta.5 Description A cross-site scripting XSS issue exists in the link-to helper of Ember.js. This allows remote attackers to...
CVE-2014-2231: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property title...
CVE-2014-0046: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute...
PT-2014-4569
Name of the Vulnerable Software and Affected Versions synetics i-doit pro versions prior to 1.2.5 Description The issue is related to a cross-site scripting XSS vulnerability in the API. This allows remote attackers to inject arbitrary web script or HTML via a property title. Recommendations For...
WordPress BSK PDF Manager 1.3 Cross Site Scripting
============================================================== Title ...| XSS in BSK PDF Manager Version .| bsk-pdf-manager 1.3 Date ....| 23.02.2014 Found ...| HauntIT Blog Home ....| http://wordpress.org/plugins/ ==============================================================...
PT-2014-2807
Name of the Vulnerable Software and Affected Versions Drupal Bean module versions 7.x-1.x before 7.x-1.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the bean title. Recommendations For versions prior to 7.x-1.5, update to version...
CVE-2013-4499: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Bean module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via the bean title...
WordPress Kiddo Theme "uploadify.php"任意文件上传漏洞
WordPress Kiddo是WordPress的儿童主题。 WordPress Kiddo的/wp-content/themes/kiddo/app/assets/js/uploadify/uploadify.php脚本允许上传任意扩展名的文件到webroot的文件夹内，如果上传的文件包含恶意PHP脚本，即可导致执行任意PHP代码。 0 WordPress Kiddo 1.x 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
Fedora 20 : ikiwiki-3.20140125-1.fc20 (2014-1747)
Update to the latest stable version. Changes in ikiwiki 3.20140125 : - inline: Allow overriding the title of the feed. Closes: http://bugs.debian.org/735123 Thanks, Christophe Rhodes - osm: Escape name parameter. Closes: http://bugs.debian.org/731797 Changes in ikiwiki 3.20140102 : - aggregate:...
Ember.js XSS Vulnerability With {{link-to}} Helper in Non-block Form
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, a change made to the implementation of the link-to helper means that any user-supplied data bound to the link-to helper's title attribute will not be escaped...
PT-2014-3361
Name of the Vulnerable Software and Affected Versions Download Manager plugin versions prior to 2.5.9 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the title field. This could potentially lead to unauthorized actions on the affecte...
CVE-2013-7319: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field...
CVE-2013-1466
Multiple cross-site scripting XSS vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the 1 subject parameter to profiles.php; 2 address1, 3 address2, 4 calendartype, 5 city, 6 state, 7 title, 8 url, or 9 zipcode parameter to...
CVE-2013-0177
Multiple cross-site scripting XSS vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project aka OFBiz 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the 1 Screenlet.title or 2...