Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the 1 username, 2 first name, or 3 last name in a a create or b edit user action...

CVE-2014-5441

Multiple cross-site scripting XSS vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the 1 username, 2 first name, or 3 last name in a a create or b edit user action...

SiteBar <= 3.3.8 command.php Modify User Action uid Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/26126/info SiteBar is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input. These issues include: - A local file-include vulnerability - Multiple...

CVE-2014-3883

Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action...

CVE-2014-1276

IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app that accesses an IOKit framework interface...

Design/Logic Flaw

IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app that accesses an IOKit framework interface...

CVE-2014-1276

CVE-2014-1276 affects Apple iOS prior to 7.1 via the IOKit HID Event interface. The vulnerability allows a crafted app to monitor user actions across arbitrary apps by accessing an IOKit framework interface, due to insufficient access controls in IOKit. Apple addressed this in iOS 7.1 (patch link...

CVE-2013-4889

Multiple cross-site request forgery CSRF vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new administrator via the AddUser action or 2 conduct cross-site scripting XSS attacks, as demonstrat...

CVE-2013-5316

Cross-site request forgery CSRF vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via an edit user action to cms/index.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via an edit user action to cms/index.php...

CVE-2013-5316

The CVE-2013-5316 entry describes a CSRF vulnerability in RiteCMS 1.0.0 that lets an attacker hijack administrator sessions to perform password changes via an admin action to cms/index.php. The affected component is the RiteCMS 1.0.0 admin password change flow; root cause is inadequate CSRF prote...

CVE-2012-4932

Multiple cross-site scripting XSS vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via 1 the having parameter in a manage action to index.php; 2 the Email field in an Add User action; 3 the Customer Name field in an Add...

Double-clicking a link can unexpectedly run a program from the Internet

When a user clicks a link on a Web page that points to an executable file, Opera will show a download dialog to allow the user to download it. The dialog will allow the user to choose to run the executable directly. If the user accidentally double clicks, the second click will activate whatever i...

CVE-2010-0709

Multiple cross-site request forgery CSRF vulnerabilities in Limny 2.0 allow remote attackers to 1 hijack the authentication of users or administrators for requests that change the email address or password via the user action to index.php, and 2 hijack the authentication of the administrator for...

CVE-2009-3789

Multiple cross-site scripting XSS vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the lastmessage parameter to 1 add.php, 2 toBePublished.php, 3 index.php, and 4 admin.php; the PATHINFO to the default URI to 5 category.php, 6 department.php, 7...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the lastmessage parameter to 1 add.php, 2 toBePublished.php, 3 index.php, and 4 admin.php; the PATHINFO to the default URI to 5 category.php, 6 department.php, 7...

Download connection

Added: 03/18/2009 Background This tool allows you to download a file which, when executed, establishes a command connection. Limitations This tool requires a user to execute the downloaded file in order to succeed. The target field must be a licensed target but is unused. Platforms Windows Linux...

CVE-2008-3679

Multiple cross-site scripting XSS vulnerabilities in index.php in IDevSpot PhpLinkExchange 1.01 allow remote attackers to inject arbitrary web script or HTML via the catid parameter in a 1 useradd, 2 recip, 3 tellafriend, or 4 contact action, or 5 in a request without an action; or 6 the id...

CVE-2007-6001

Multiple cross-site scripting XSS vulnerabilities in index.php in Bandersnatch 0.4 allow remote attackers to inject arbitrary web script or HTML via the 1 func or 2 date parameter, or the jid parameter in a 3 log or 4 user action, a different vulnerability than CVE-2007-3910...

CVE-2007-5692

Multiple cross-site scripting XSS vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web script or HTML via 1 the lang parameter to integrator.php; 2 the token parameter in a New Password action, 3 the nidacl parameter in a Folder Properties action, or 4 the uid parameter...