Multiple cross-site scripting (XSS) vulnerabilities in Spymac Web OS 4.0 allow remote attackers to inject arbitrary web script or HTML via (a) the blogs module including the (1) curr parameter in index.php (2) inspire (3) system or (4) title parameter in blog_newentry.php (5) entry parameter in blog_newentry_comment.php (6) entry parameter in blog_edit_entry.php or (7) caldate parameter in blog.php; and (b) the notes module including the (1) forwardid parameter in a noteform action; (2) del_folder parameter in a delete_folder action; (3) isread (4) dateorder (5) subjectorder (6) curr (7) fromorder or (8) action parameters; (9) ppp or (10) totalreplies parameter in an Inbox action; (11) totalnotes parameter; or (12) touserid parameter in a noteform action.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

MySource

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

in

the

stylesheet

parameter

in

and

the

bgcolor

parameter

in

header.php

and


Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to blank.html or the createdataCX parameter to (2) calendar_d.html (3) calendar_m.html or (4) calendar_w.html.


Interpretation conflict in phpBB 2.0.17 with remote avatars and avatar uploading enabled allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG file extension which causes the HTML to be executed by a victim who views the file in Internet Explorer which renders malformed image types as HTML enabling cross-site scripting (XSS) attacks. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer (CVE-2005-3312) and the proper fix should be in that browser; if so then this should not be treated as a vulnerability in phpBB.


PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the phpicalendar cookie. NOTE: this is not a cross-site scripting (XSS) issue as claimed by the original researcher.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

vBulletin

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

certain

arguments

to

announcement.php

admincalendar.php

bbcode.php

cronadmin.php

email.php

faq.php

forum.php

image.php

language.php

ranks.php

replacement.php

replacement.php

template.php

template.php

usergroup.php

or

usertitle.php.


Cross-site scripting (XSS) vulnerability in the Entropy Chat script in cPanel 10.2.0-R82 and 10.6.0-R137 allows remote attackers to inject arbitrary web script or HTML via a chat message containing Javascript in style attributes in tags such as <b> which are processed by Internet Explorer.


Cross-site scripting (XSS) vulnerability in Comersus BackOffice allows remote attackers to inject arbitrary web script or HTML via the error parameter to comersus_backoffice_supportError.asp. NOTE: the comersus_backoffice_message.asp/message vector is already covered by CVE-2005-2191 item 2.


Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to inject arbitrary web script or HTML via (1) the _base_href parameter in translate.php (2) the _base_path parameter in news.inc.php and (3) the p parameter in add_note.php.


Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listname parameter in (a) admin/editlist.php (2) title parameter in (b) admin/spageedit.php (3) title field in (c) admin/template.php (4) filter (5) delete and (6) start parameters in (d) admin/eventlog.php (7) id parameter in (e) admin/configure.php (8) find parameter in (f) admin/users.php (9) start parameter in (g) admin/admin.php and (10) action parameter in (h) admin/fckphplist.php.


Multiple cross-site scripting (XSS) vulnerabilities in PHPKIT 1.6.1 R2 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple vectors in (1) login/profile.php (2) login/userinfo.php (3) admin/admin.php (4) imcenter.php and the (5) referer statistics the (6) HTML title element and (7) logo alt attributes in forum postings and the (8) Homepage field in the Guestbook.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ATutor

and

RC

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

browse.php

subject

parameter

to

contact.php

cid

parameter

to

content.php

l

parameter

to

the

search

words

include

or

search

parameter

to

search.php

the

submit

query

or

field

parameter

to

tile.php

the

us

parameter

to

or

the

roles

status

submit

or

parameters

to

directory.php.


Multiple cross-site scripting (XSS) vulnerabilities in PhpAuction 2.5 allow remote attackers to inject arbitrary web script or HTML via the lan parameter to (1) index.php or (2) admin/index.php or (3) the auction_id parameter to profile.php. NOTE: there is evidence that viewnews.php and login.php may not be part of the PhpAuction product so they are not included in this description.


Multiple cross-site scripting (XSS) vulnerabilities in GuppY 4.5.3a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pg parameter to printfaq.php or the (2) Referer or (3) User-Agent HTTP headers which are not properly handled by error.php.


** DISPUTED ** Note: the vendor has disputed this issue. Multiple cross-site scripting (XSS) vulnerabilities in Land Down Under (LDU) 800 allow remote attackers to inject arbitrary web script or HTML via the (1) c or (2) m parameters to index.php or (3) w parameter to journal.php. NOTE: this issue has been disputed by the vendor who says \None of the tricks written there are working the variables are properly sanitized and no LDU version is affected.\


Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir parameter as identified by bug#0005959 and a different vulnerability than CVE-2005-3090.


Multiple cross-site scripting (XSS) vulnerabilities in Looking Glass 20040427 allow remote attackers to inject arbitrary web script or HTML via the (1) versionfullname (2) versionhomepage or (3) versionno parameter to footer.php or the (4) versionfullname (5) versionno (6) versionauthor (7) versionemail parameter to header.php.


Unknown vulnerability in Webmail in iPlanet Messaging Server 5.2 Patch 1 and Sun ONE Messaging Server 6.2 allows remote attackers to execute arbitrary Javascript possibly due to a cross-site scripting (XSS) vulnerability.


Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) bodycolor (2) backimage (3) theme or (4) logo parameter to structure.php (5) admin (6) admin_mail or (7) back parameter to footer.php or (8) the message body in a news post.


Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier XOOPS 2.0.13.1 and earlier and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that use \XOOPS Code\ and (2) newbb in the forum module.


Multiple cross-site scripting vulnerabilities in ASP Nuke 0.80 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to forgot_password.asp or the (2) FirstName (3) LastName (4) Username (5) Password (6) Address1 (7) Address2 (8) City (9) ZipCode (10) Email parameter to register.asp.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

phpCommunityCalendar

and

possibly

earlier

versions

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

LocationID

parameter

to

thankyou.php

or

day.php

font

parameter

to

calDaily.php

calMonthly.php

calMonthlyP.php

calWeekly.php

calWeeklyP.php

calYearly.php

calYearlyP.php

day.php

or

week.php

or

CeTi

Contact

Description

ShowAddress

parameter

to

event.php

and

other

attack

vectors.


options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable which allows remote attackers to modify or read the preferences of other users conduct cross-site scripting XSS) attacks and write arbitrary files.


Multiple cross-site scripting (XSS) vulnerabilities in MAXdev MD-Pro 1.0.73 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via (1) the print parameter to the print module the sitename parameter to (2) bb_smilies or (3) bbcode_ref module or (4) the hlpfile parameter to openwindow.php.


Multiple cross-site scripting (XSS) vulnerabilities in Simple Message Board Version 2.0 Beta 1 allow remote attackers to inject arbitrary web script or HTML via the (1) FID parameter to forum.cfm (2) UID parameter to user.cfm (3) TID parameter to thread.cfm or (4) PostDate parameter to search.cfm.


Multiple cross-site scripting (XSS) vulnerabilities in SaveWebPortal 3.4 allow remote attackers to inject arbitrary web script or HTML via a large number of parameters to (1) footer.php (2) header.php (3) menu_dx.php or (4) menu_sx.php or Javascript code in the (5) HTTP_REFERER (referer) or (6) HTTP_USER_AGENT (user agent) fields.


Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.0.105 allows remote attackers to inject arbitrary web script or HTML via a news or article post possibly involving the (1) news_body (2) article_description or (3) article_body parameters to submit.php.


Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via a file attachment that is processed by the Display feature. NOTE: the severity of this issue has been disputed by the developer.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Comersus

shopping

cart

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

name

parameter

to

comersus_backoffice_listAssignedPricesToCustomer.asp

or

message

parameter

to


Multiple

cross-site

scripting

vulnerabilities

in

Ultimate

PHP

Board

(UPB)

GOLD

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

ref

parameter

to

login.php

id

or

page

parameter

to

viewtopic.php

id

parameter

to

profile.php

newpost.php

email.php

icq.php

or

aol.php

parameter

to

newpost.php

ref

parameter

to

getpass.php

or

sText

parameter

to

search.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

FunkBoard

and

possibly

earlier

versions

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

fbusername

or

fbpassword

parameter

to

editpost.php

prefs.php

newtopic.php

reply.php

or

profile.php

the

fbusername

fmail

www

icq

yim

location

sex

interebbies

sig

or

aim

parameter

to

register.php

or

subject

parameter

to

newtopic.php.


Multiple cross-site scripting (XSS) vulnerabilities in DVBBS 7.1 SP2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the page parameter to dispbbs.asp (2) name parameter to dispuser.asp or the (3) title (4) view or (5) act parameter to boardhelp.asp.


Multiple cross-site scripting (XSS) vulnerabilities in MySQL Eventum 1.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to view.php (2) release parameter to list.php or (3) F parameter to get_jsrs_data.php.


Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via an HTML e-mail containing tags with strings that contain \>\ or other special characters which is not properly sanitized by SqWebMail.


Cross-site scripting (XSS) vulnerability in Computer Associates (CA) eTrust SiteMinder 5.5 when the \CSSChecking\ parameter is set to \NO \ allows remote attackers to inject arbitrary web script or HTML via the (1) PASSWORD or (2) BUFFER parameters to smpwservicescgi.exe (3) the TARGET parameter to login.fcc and possibly other vectors.


Cross-site scripting (XSS) vulnerability in N-Stealth Commercial Edition before 5.8.0.38 and Free Edition before 5.8.1.03 allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response header which is directly injected into an HTML report.


Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in \My Control Center \ which is not properly handled by control.php.


Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) forum_id or (2) group_id parameter to forum.php (3) project_task_id parameter to task.php (4) id parameter to detail.php (5) the text field on the search page (6) group_id parameter to qrs.php (7) form (8) rows (9) cols or (10) wrap parameter to notepad.php or the login field on the login form.


Multiple cross-site scripting (XSS) vulnerabilities in PHPFreeNews 1.40 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) NewsMode parameter to NewsCategoryForm.php or the (2) Match or (3) NewsMode parameter to SearchResults.php.


Multiple cross-site scripting (XSS) vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) debug parameter to showenv (2) test parameter to parsequery or (3) delimiter or (4) CELLWRAPPER parameter to rwservlet.


Cross-site scripting (XSS) vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265 332 and 340 420 through 490 and 535 through 555 allows remote attackers to inject arbitrary web script or HTML and modify web pages via unknown vectors.


SafeHTML before 1.3.5 does not properly filter script in UTF-7 and CSS comments which allows remote attackers to conduct cross-site scripting (XSS) attacks in vulnerable applications that use SafeHTML.


Cross-site scripting (XSS) vulnerability in Greymatter allows remote attackers to inject arbitrary web script or HTML via a post comment which is recorded in a log file but not properly handled when the administrator uses \View Control Panel Log\ to read the log file.


Multiple cross-site scripting (XSS) vulnerabilities in PHPOpenChat 3.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) content parameter to profile.php and profile_misc.php (3) the profile fields in userpage.php (4) subject or (5) body in mail.php or (8) disinvited_chatter or (7) invited_chatter parameter to invite.php.


Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar name field when creating calendars (2) event title field when deleting events the (3) Category and (4) Location search fields and the (5) attendees email address fields when editing event attendees and possibly other vectors.


Multiple cross-site scripting (XSS) vulnerabilities in mimic2.cgi in mimicboard2 (Mimic2) 086 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters associated with the (1) name (2) title and (3) comment sections as demonstrated by referencing a remote document through the SRC attribute of an IFRAME element.


Multiple cross-site scripting (XSS) vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web script or HTML via (1) the tasklist's name or (2) description when creating a new tasklist.


Cross-site scripting (XSS) vulnerability in myEZshop Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the Keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Michael Arndt WebCal 1.11-3.04 allow remote attackers to inject arbitrary web script or HTML via the (1) function (2) year and (3) date parameters to webcal.cgi (4) new calendar entries and (5) notes for entries.


** DISPUTED ** Cross-site scripting (XSS) vulnerability in Fidra Lighthouse CMS 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a query_string to the home page. NOTE: The vendor disputes this issue saying \Lighthouse does not in any way make use of the PHP technology. It is an application server ... A technology like this cannot be susceptible to client-side cross-site-scripting-attacks on its own but only applications created based on such a technology. This does not only apply to Lighthouse but also to Perl PHP or web applications based on Java Servlet technology.\ Since the original researcher is known to test demo pages and is sometimes inaccurate it is likely that this issue will be REJECTED.


Cross-site scripting (XSS) vulnerability in AbleDesign ReSearch 2.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in jax_guestbook.php in Jax Guestbook 3.1 and 3.31 allow remote attackers to inject arbitrary web script or HTML via the (1) gmt_ofs and (2) language parameters. NOTE: the page parameter is already covered by CVE-2006-1913. NOTE: it was later reported that 3.50 is also affected.


Cross-site scripting (XSS) vulnerability in Koobi 5 allows remote attackers to inject arbitrary web script or HTML via nested malformed url BBCode tags. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Binary Board System (BBS) 0.2.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) inreplyto (2) article and (3) board parameters to reply.pl (4) branch (5) board and (6) stats.pl parameters to (b) stats.pl and (7) board parameter to (c) toc.pl.


Multiple cross-site scripting (XSS) vulnerabilities in UStore allow remote attackers to inject arbitrary web script or HTML via the (1) Cat parameter in default.asp and the (2) accessdenied parameter in admin/default.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Link Up Gold 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) link parameter to tell_friend.php (2) phrase parameter to search.php in a search_links_advanced action and the (3) direction or (4) sort parameter to articles.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

HydroBB

Beta

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

s

parameter

to

search.php

members.php

stats.php

viewforum.php

register.php

usercp.php

groups.php

pms.php

and

calendar.php.


Cross-site scripting (XSS) vulnerability in error.asp in AudienceView allows remote attackers to inject arbitrary web script or HTML via the TSerrorMessage parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in auction.pl in EveryAuction 1.53 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter. NOTE: the provenance of this issue is unknown; the details were obtained solely from third party sources and independently verified using source code inspection.


Cross-site scripting (XSS) vulnerability in the News module in Envolution allows remote attackers to inject arbitrary web script or HTML via the (1) startrow and (2) catid parameter. NOTE: this issue might be resultant from the SQL injection problem (CVE-2005-4263).


Cross-site scripting (XSS) vulnerability in Oracle Application Server (OracleAS) Discussion Forum Portlet allows remote attackers to inject arbitrary web script or HTML via the (1) RowKeyValue parameter in the PORTAL schema; and the (2) title and (3) content input fields when creating an forum article.


Cross-site scripting (XSS) vulnerability in httprint v202 and possibly other versions before v301 allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response which is not sanitized before being displayed to the user.


Multiple cross-site scripting (XSS) vulnerabilities in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Homepage field (aka the Website field) in an \image-related comment\ and (2) the img_size field in view.php. NOTE: due to lack of details from the researcher it is not clear whether the comment vector overlaps CVE-2005-1886.


Cross-site scripting (XSS) vulnerability in index.php AbleDesign D-Man 3.x allows remote attackers to inject arbitrary web script or HTML via the title parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (2) base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.2 and unspecified other console scripts in these products allow remote attackers to inject arbitrary web script or HTML via the sig1 parameter and possibly other parameters a different vulnerability than CVE-2007-6156.


Cross-site scripting (XSS) vulnerability in forum.asp in ASP-DEV XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via the forum_title parameter. NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID. In addition its accuracy is in question because \forum_title\ does not appear to be specified in the source code for XM Forum RC3. It is possible but not certain that this is CVE-2004-2211.


Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to inject arbitrary web script or HTML via the (1) sort_mode parameter to (a) fisheye/list_galleries.php (b) messages/message_box.php and (c) users/my.php; the (2) post_id parameter to (d) blogs/view_post.php; the (3) blog_id parameter to (e) blogs/view.php; and the (4) search field to (f) users/my_groups.php.


Unrestricted file upload vulnerability in eZ publish 3.5 before 3.5.5 3.6 before 3.6.2 3.7 before 3.7.0rc2 and 3.8 before 20050922 does not restrict Image datatype uploads to image content types which allows remote authenticated users to upload certain types of files as demonstrated by .js files which may enable cross-site scripting (XSS) attacks or other attacks.


Cross-site scripting (XSS) vulnerability in ProjectForum 4.7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) fwd parameter in admin/adminsignin.html and (2) originalpageid parameter in admin/newpage.html associated with a group.


Cross-site scripting (XSS) vulnerability in the editavatar page in vBulletin 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a URL in the remote avatar url field in which the URL generates a parsing error and possibly requiring a trailing extension such as .jpg.


Cross-site scripting (XSS) vulnerability in add.php in DEV web management system 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) ENTER_ARTICLE_TITLE (2) SPECIFY_ZONE (3) ENTER_ARTICLE_HEADER and (4) ENTER_ARTICLE_BODY indices in the language array parameter.


** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in MilliScripts 1.4 redirect script allow remote attackers to inject arbitrary web script or HTML via the domainname parameter to register.php and other unspecified vectors. NOTE: the vendor has disputed this issue stating \No invalid input can reach the script.\


** DISPUTED ** NOTE: the vendor has disputed this issue. Cross-site scripting (XSS) vulnerability in lemoon 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters possibly the q parameter. NOTE: the vendor has disputed this issue saying \Sites are built on top of ASP.NET and you use lemoon core objects to easily manage and render content. The XSS vuln. you are referring to exists in one of our public sites built on lemoon i.e. a custom made site (as all sites are). The problem exists in a UserControl that handles form input and is in no way related to the lemoon core product.\


Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors as demonstrated by (1) the identity field (2) Category and (3) Label search fields (4) the Mobile Phone field and (5) Date and (6) Time fields when importing CSV files as exploited through modules such as (a) Turba Address Book (b) Kronolith (c) Mnemo and (d) Nag.


Multiple cross-site scripting (XSS) vulnerabilities in Hitachi Cosminexus Collaboration Portal 06-00 through 06-10-/B Groupmax Collaboration Portal 07-00 through 07-10-/B and Groupmax Collaboration Web Client 07-00 through 07-10-/A allow remote attackers to inject arbitrary web script or HTML via the (1) Schedule and (2) Calendar components.


Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0 8.1 SP4 and earlier 7.0 SP6 and earlier and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors.


WorldClient webmail in Alt-N MDaemon 8.1.3 allows remote attackers to prevent arbitrary users from accessing their inboxes via script tags in the Subject header of an e-mail message which prevents the user from being able to access the Inbox folder possibly due to a cross-site scripting (XSS) vulnerability.


Cross-site scripting (XSS) vulnerability in search.asp in NetDirect ShopEngine allows remote attackers to inject arbitrary web script or HTML via the EXPS parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in ThWboard before 3 Beta 2.84 allow remote attackers to inject arbitrary web script or HTML via the (1) Wohnort and (2) Beruf fields in editprofile.php (3) user parameter array in v_profile.php and (4) the action parameter in misc.php.


Multiple cross-site scripting (XSS) vulnerabilities in index.cfm in CF_Nuke 4.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topic and (2) newsid parameter in the news sector and (3) cat parameter in the links sector.


viewcvs in ViewCVS 0.9.2 allows remote attackers to set the Content-Type header to arbitrary values via the content-type parameter which can be leveraged for cross-site scripting (XSS) and other attacks as demonstrated using (1) \text/html\ or (2) \image/jpeg\ with an image that is rendered as HTML by Internet Explorer a different vulnerability than CVE-2004-1062. NOTE: it was later reported that 0.9.4 is also affected.


Cross-site scripting (XSS) vulnerability in register_domain.php in DRZES HMS 3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters possibly the \Domain Availability\ field. NOTE: this issue was later reported to affect CONTROLzx (renamed from DRZES) 3.3.4.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

QuickPayPro

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

various

fields

such

as

those

in

communication/subscribers.tracking.add.php

support/tickets.add.php

and

mycompany/categories.php.


Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer which ignores the characters.


Cross-site scripting (XSS) vulnerability in admin/Default.asp in iCMS allows remote attackers to inject arbitrary web script or HTML via the LoginMSG parameter. NOTE: the provenance of this issue is unknown; the details were obtained solely from third party sources.


Multiple cross-site scripting (XSS) vulnerabilities in Sitekit CMS 6.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) query string (2) textonly (3) locID and (4) lang parameters to (a) Default.aspx and the (6) ClickFrom parameter to (b) Request-call-back.html and (c) registration-form.html. NOTE: the vendor states \This issue was resolved by a minor update to Sitekit CMS v6.6 sanitising the html code and eradicating related security issues.\


Cross-site scripting (XSS) vulnerability in StaticStore Search Engine 1.189A and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to search.cgi possibly the keywords parameter. NOTE: this issue was originally disputed by the vendor but it has since been acknowledged.


Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter as demonstrated by elements such as \<me<meta>ta\ and \<sc<script>ript>\.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ProjectApp

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

keywords

parameter

to

forums.asp

cat.asp

and

links.asp;

projectid

parameter

to

pmprojects.asp

parameter

to

login.asp

and

parameter

to

default.asp.


Multiple cross-site scripting (XSS) vulnerabilities in templates/notepads/notepads.inc in Horde Mnemo Note Manager H3 before 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) the notepad's name or (2) description when creating a new notepad.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) nav parameter in the downloads module (2) Full Name and (3) Email fields in the core module (4) Full Name (5) Email and (6) Subject fields in the tickets module or (7) Registered Email field in the lostpassword feature in the core module.


Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.2.2 and possibly other versions before 2.3.0 Beta 2 allows remote attackers to inject arbitrary web script or HTML via the username parameter a different vulnerability than CVE-2005-4877.


Multiple cross-site scripting (XSS) vulnerabilities in the UpdateEngine program in Fatwire UpdateEngine 6.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) COUNTRYNAME (2) EMAIL and (3) FUELAP_TEMPLATENAME parameters.


Multiple cross-site scripting (XSS) vulnerabilities in Advanced Guestbook 2.2 and 2.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the entry parameter in index.php and (2) the gb_id parameter in comment.php. NOTE: The index.php/entry vector might be resultant from CVE-2005-1548.


** DISPUTED ** Cross-site scripting (XSS) vulnerability in Polopoly 9 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters. NOTE: the vendor has disputed this vulnerability stating that the \XSS flaw was only part of the custom implementation of the polopoly site\. As of 20061003 CVE has no further information on this issue except that the original researcher has a history of testing live sites and assuming that discoveries indicate vulnerabilities in the associated package.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Scout

Portal

Toolkit

(SPT)

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

ss

parameter

in

SPT--QuickSearch.php;

ParentId

parameter

in

SPT--BrowseResources.php;

the

ResourceId

parameter

in

SPT--FullRecord.php;

ResourceOffset

parameter

in

SPT--Home.php

parameter

in

SPT--QuickSearch.php;

and

parameters

in

SPT--UserLogin.php;

ResourceType

Language

Audience

Format

parameters

in

SPT--AdvancedSearch.php.


Cross-site scripting (XSS) vulnerability in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424 6.2.3.23 and other versions before 6 allows remote attackers to inject arbitrary web script or HTML via the context parameter to announcement.pl which is reflected in the resulting page.


Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp (2) el/implicit-objects.jsp and (3) jspx/textRotate.jspx in examples/jsp2/ as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported but these require admin access and do not cross privilege boundaries.


Cross-site scripting (XSS) vulnerability in index.cfm in CitySoft Community Enterprise 4.x allows remote attackers to inject arbitrary web script or HTML via the (1) presentationSite (2) docPublishYear (3) docDescription (4) publishState (5) docAuthor (6) docTitle (7) subTopic (8) topic (9) topicRadio (10) topicOnly (11) startrow and (12) sortby parameters.


Multiple cross-site scripting (XSS) vulnerabilities in Ideal BB.NET 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) forumID (2) boardID and (3) topicRepeater1-p parameters in topics.aspx (4) boardID parameter in categoryindex.aspx (5) postID parameter in posts.aspx (6) catID parameter in forums.aspx and (7) memberID parameter in member.aspx.


Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.3.0 Beta 2 allows remote attackers to inject arbitrary web script or HTML via Javascript events in the username parameter a different vulnerability than CVE-2005-4876.


Multiple cross-site scripting (XSS) vulnerabilities in sample scripts in IBM WebSphere Application Server 6 allow remote attackers to inject arbitrary web script or HTML via the (1) E-mail address field to (a) PlantsByWebSphere/login.jsp (2) message field to (b) TechnologySample/BulletinBoard Script (3) Email address field to (c) TechnologySamples/Subscription and the (4) Movie Name (5) Movie Reviewer and (6) Movie Review fields to (d) TechnologySamples/MovieReview2_1.


Multiple cross-site scripting (XSS) vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows and P-1M43-9111 01-01 through 02-00 on AIX allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in an unspecified input form.


Cross-site scripting (XSS) vulnerability in Absolute Image Gallery XE 2.x allows remote attackers to inject arbitrary web script or HTML via the text parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


MediaWiki before 1.5.4 uses a hard-coded \internal placeholder string\ which allows remote attackers to bypass protection against cross-site scripting (XSS) attacks and execute Javascript using inline style attributes which are processed by Internet Explorer.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

AlstraSoft

EPay

Enterprise

(formerly

DoPays)

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

multiple

unspecified

parameters

in

profile.htm

card.htm

bank.htm

subscriptions.htm

send.htm

request.htm

forgot.htm

escrow.htm

donations.htm

and

products.htm.


Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005 when the cleancss option is enabled allows remote attackers to conduct cross-site scripting (XSS) attacks via a \\\\ (backslash) within a \javascript\ scheme in a style property (such as \javas\\cript\) which bypasses the \javascript\ check before the \\\\ is stripped and then rendered in web browsers that allow scripting in style sheets.


Multiple cross-site scripting (XSS) vulnerabilities in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (Build 4.4.000 Oct 26 2005) allow remote attackers to inject arbitrary web script or HTML by sending (1) the href parameter to index.fts or the param1 parameter to (2) /domains/index.fts (3) /config/licence.fts or (4) /config/systemacl.fts.


Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting (XSS) attacks by replacing the \>\ in the tag with a \<\ which bypasses the regular expressions that sanitize the data but is automatically corrected by many web browsers. NOTE: it could be argued that this vulnerability is due to a design limitation of many web browsers; if so then this should not be treated as a vulnerability in PHP-Nuke.


Multiple cross-site scripting (XSS) vulnerabilities in SCOOP! 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword and (2) invalid parameter to articleSearch.asp; (3) username and (4) invalid parameter to lostPassword.asp; (5) Username (6) Password and (7) invalid parameter to account_login.asp; (8) area (9) articleZoneID (10) r and (11) invalid parameters to category.asp; and invalid parameters to (12) articleZone.asp (13) prePurchaserRegistration.asp and (14) requestDemo.asp.


Cross-site scripting (XSS) vulnerability in configure.asp in Script-Shed GuestBook 1.0 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in (1) image (2) img (3) image=right (4) img=right (5) image=left and (6) img=left tags.


Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2 1.0.2.2 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field.


Cross-site scripting (XSS) vulnerability in E-Guest_sign.pl in E-Guest 1.1 allows remote attackers to inject arbitrary SSI directives web script and HTML via the (1) full name (2) email (3) homepage and (4) location parameters. NOTE: this issue might overlap CVE-2005-1605.


Cross-site

scripting

(XSS)

vulnerability

in

in

PortailPHP

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

variables.


Cross-site scripting (XSS) vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0 when running on Windows 2000 with \Enable folder view for FTP sites\ and \Enable Web content in folders\ selected allows remote attackers to inject arbitrary web script or HTML via the hostname portion of an FTP URL.


member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer which causes an error message to be reflected back to the user without quoting which facilitates cross-site scripting (XSS) and possibly other attacks.


Cross-site scripting vulnerability AOL Instant Messenger (AIM) 4.5 and 4.7 for MacOS and Windows allows remote attackers to conduct unauthorized activities such as adding buddies and groups to a user's buddy list via a URL with a META HTTP-EQUIV=\refresh\ tag to an aim: URL.


Multiple cross-site scripting (XSS) vulnerabilities in magicHTML of SquirrelMail before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via (1) \<<script\ in unspecified input fields or (2) a javascript: URL in the src attribute of an IMG tag.


Cross-site scripting (XSS) vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) ctr parameter in Default.asp and (2) the query string to formslogin.asp.


Cross-site scripting (XSS) vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via a private message with a javascript: URL in the IMG tag in which the URL ends in a \.gif\ or \.jpg\ string a variant of CVE-2002-0328.


Cross-site scripting (XSS) vulnerability in VisNetic Website before 3.5.15 allows remote attackers to inject arbitrary web script or HTML via the HTTP referer header (HTTP_REFERER) to a non-existent page which is injected into the resulting 404 error page.


Cross-site scripting vulnerabilities in ASP-Nuke RC2 and earlier allow remote attackers to execute script or gain privileges as other ASP-Nuke users via script in (1) the name parameter in downloads.asp (2) the message parameter in Post.asp or (3) a web site URL in profile.asp.


Cross-site scripting (CSS) vulnerabilities in the Private Message System for XOOPS 1.0 RC1 allow remote attackers to execute Javascript on other web clients via (1) the Title field or a Private Message Box or (2) the image field parameter in pmlite.php.


Microsoft Internet Explorer 5.01 and 5.5 allows remote attackers to execute scripts in the Local Computer zone via a URL that references a local HTML resource file a variant of \Cross-Site Scripting in Local HTML Resource\ as identified by CAN-2002-0189.


Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain which could allow remote attackers to execute arbitrary script in documents that the user does not expect possibly through web applications that use a text/plain type to prevent cross-site scripting attacks.


Cross-site scripting vulnerability in YaBB.cgi for Yet Another Bulletin Board (YaBB) 1 Gold SP1 and earlier allows remote attackers to execute arbitrary script as other web site visitors via script in the num parameter which is not filtered in the resulting error message.


Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method which allows remote attackers to execute script in other clients via the NFuse_Application parameter to (1) launch.jsp or (2) launch.asp.


Datalex PLC BookIt! Consumer before 2.2 stores usernames and passwords in plaintext in a cookie which could allow remote attackers to gain privileges via Cross-site scripting or sniffing attacks.


Cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2) allows remote attackers to execute Javascript as other phpBB users by including a http:// and a double-quote (\) in the IMG tag which bypasses phpBB's security check terminates the src parameter of the resulting HTML IMG tag and injects the script.


Opera when configured with the \Determine action by MIME type\ option disabled interprets an object as an HTML document even when its MIME Content-Type is text/plain which could allow remote attackers to execute arbitrary script in documents that the user does not expect possibly through web applications that use a text/plain type to prevent cross-site scripting attacks.


Cross-site

scripting

vulnerability

in

auction.pl

of

MakeBid

Auction

Deluxe

allows

remote

attackers

to

obtain

information

from

other

users

via

the

form

fields

TITLE

DESCTIT

DESC

searchstring

ALIAS

EMAIL

or


Cross-site scripting (CSS) vulnerability in IcrediBB 1.1 Beta allows remote attackers to execute arbitrary script and steal cookies as other IcrediBB users via the (1) title or (2) body of posts.


Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43 and 1.3.x up to 1.3.26 when UseCanonicalName is \Off\ and support for wildcard DNS is present allows remote attackers to execute script as other web page visitors via the Host: header a different vulnerability than CAN-2002-1157.


Cross-site scripting vulnerability in CaupoShop 1.30a and earlier and possibly CaupoShopPro allows remote attackers to execute arbitrary Javascript and steal credit card numbers or delete items by injecting the script into new customer information fields such as the message field.


Cross-site scripting vulnerability in signgbook.php for BG GuestBook 1.0 allows remote attackers to execute arbitrary Javascript via encoded tags such as < > and & in fields such as (1) name (2) email (3) AIM screen name (4) website (5) location or (6) message.


Cross-site scripting (CSS) vulnerability in error.asp for Plumtree Corporate Portal 3.5 through 4.5 allows remote attackers to execute arbitrary script on other clients via the \Description\ parameter.


Cross-site scripting vulnerabilities in GeekLog 1.3.5 and earlier allow remote attackers to execute arbitrary script via (1) the url variable in the Link field of a calendar event (2) the topic parameter in index.php or (3) the title parameter in comment.php.


Cross-site scripting vulnerabilities in MyHelpDesk 20020509 and possibly other versions allows remote attackers to execute script as other users via a (1) Title or (2) Description when a new ticket is created by a support assistant via the \id\ parameter to the index.php script with the (3) tickettime (4) ticketfiles or (5) updateticketlog operations or (6) via the update section when a ticket is edited.


Cross-site scripting (XSS) vulnerability in Errors.gsl in Imatix Xitami 2.5b4 and 2.5b5 allows remote attackers to inject arbitrary web script or HTML via the (1) Javascript events as demonstrated via an onerror event in an IMG SRC tag or (2) User-Agent field in an HTTP GET request.


Multiple cross-site scripting (XSS) vulnerabilities in Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to inject arbitrary web script or HTML via (1) Text Features in the DHTML UI or (2) the test parameter to the oracle.apps.cz.servlet.UiServlet servlet.


Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the <frame> or <iframe> element and javascript aka \Frames Cross Site Scripting \ as demonstrated using the PrivacyPolicy.dlg resource.


Cross-site scripting vulnerability in Double Choco Latte (DCL) before 20020706 allows remote attackers to inject arbitrary HTML including script into web pages via the (1) Ticket# Find (2) Priorities (3) Severities (4) Projects (5) WO# Find (6) Departments and (7) Users features.


Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier when UseCanonicalName is off and wildcard DNS is enabled allows remote attackers to execute script as other web site visitors via the server name in an HTTPS response on the SSL port which is used in a self-referencing URL a different vulnerability than CAN-2002-0840.


Cross-site scripting (XSS) vulnerability in Blue Coat Systems (formerly CacheFlow) CacheOS on Client Accelerator 4.1.06 Security Gateway 2.1.02 and Server Accelerator 4.1.06 allows remote attackers to inject arbitrary web script or HTML via a URL to a nonexistent hostname that includes the HTML which is inserted into the resulting error page.


Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template which is not filtered in the resulting 404 error message.


Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive information from other clients possibly due to certain error messages from template pages that use the (1) vformat or (2) vfilter functions.


Cross-site scripting (XSS) vulnerability in the Admin Server for iPlanet WebServer 4.x up to SP11 allows remote attackers to execute web script or HTML as the iPlanet administrator by injecting the desired script into error logs and possibly escalating privileges by using the XSS vulnerability in conjunction with another issue (CVE-2002-1316).


Cross-site scripting (XSS) vulnerability in MyNewsGroups 0.4 and 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the subject of a newsgroup post which is not properly handled by (1) myarticles.php (2) search.php (3) stats.php or (4) standard.lib.php.


Cross-site scripting (XSS) vulnerability in codeparse.php in Open Bulletin Board (OpenBB) 1.0.0 RC3 allows remote attackers to inject arbitrary web script or HTML via (1) myhome.php (2) an onerror attribute in an IMG tag (a variant of CVE-2002-0330) or (3) a glow tag.


Cross-site scripting (XSS) vulnerability in JAWmail 1.0-rc1 allows remote attackers to insert arbitrary script or HTML via (1) attached file names in the Read Mail feature (2) text/html mails that are displayed in a pop-up window and (3) certain malicious attributes within otherwise safe tags such as onMouseOver.


Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP request that contains an Location: header with a \%0a%0d\ (CRLF) sequence which echoes the Location as an HTTP header in the server response.


Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory or (2) possibly other unknown attack vectors.


Cross-site scripting vulnerability in PowerBASIC urlcount.cgi as included in Lil' HTTP web server allows remote attackers to execute arbitrary web script in other web browsers via a request to urlcount.cgi that contains the script which is not filtered when the REPORT capability prints the original request.


Multiple cross-site scripting (XSS) vulnerabilities in Actinic Catalog 4.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string argument to certain .pl files (2) the REFPAGE parameter to ca000007.pl (3) PRODREF parameter to ss000007.pl or (4) hop parameter to ca000001.pl.


The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames and sub-iframes which can allow remote attackers to execute script and steal cookies from subframes that are in other domains.


An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable leaving it open to cross-site scripting attacks.


Cross-site scripting (XSS) vulnerability in W3C Jigsaw Proxy Server before 2.2.1 allows remote attackers to execute arbitrary script via a URL that contains a reference to a nonexistent host followed by the script which is included in the resulting error message.


Multiple cross-site scripting (XSS) vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) form and (2) control parameters to FCKeditor/neditor.php and the (3) path parameter to admin/siteinfo/iframe.inc.php.


Cross-site scripting (XSS) vulnerability in Six Apart Movable Type Enterprise (MTE) 1.x before 1.56; Movable Type (MT) 3.x before 3.38; and Movable Type Movable Type Open Source (MTOS) and Movable Type Enterprise 4.x before 4.23 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors possibly related to \application management.\


Cross-site scripting (XSS) vulnerability in textarea/index.php in Textpattern (aka Txp CMS) 4.0.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Body parameter in an article action. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in PHP possibly 5.2.7 and earlier when display_errors is enabled allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details it is unclear whether this is related to CVE-2006-0208.


Cross-site scripting (XSS) vulnerability in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allows remote authenticated users with create and edit permissions for posts to inject arbitrary web script or HTML via unspecified vectors involving the ajax_checklist filter.


Multiple cross-site scripting (XSS) vulnerabilities in the web interface in ClearCase RWP server in IBM Rational ClearCase 7.0.0 before 7.0.0.4 and 7.0.1.1-RATL-RCC-IFIX02 and possibly other 7.0.1 versions before 7.0.1.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO of a URI associated with a VOB page.


Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments) which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML documents.


Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11 1.12.x before 1.12.2 and 1.13.x before 1.13.3 when Internet Explorer is used and uploads are enabled or an SVG scripting browser is used and SVG uploads are enabled allows remote authenticated users to inject arbitrary web script or HTML by editing a wiki page.


Multiple cross-site scripting (XSS) vulnerabilities in Textpattern (aka Txp CMS) 4.0.5 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to setup/index.php or (2) the name parameter to index.php in the comments preview section.


awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in CMS ISWEB 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the strcerca parameter (aka the input field for the cerca action) or (2) the id_oggetto parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Yazd Forum Software 3.x allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to (a) search.jsp and the (2) msg parameter to (b) error.jsp and (c) userAccount.jsp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in index.php in Check Point Connectra NGX R62 HFA_01 allows remote attackers to inject arbitrary web script or HTML via the dir parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site

scripting

(XSS)

vulnerability

in

Mayaa

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors

involving

the

default

error

page

for

the

org.seasar.mayaa.impl.engine.PageNotFoundException

exception

and

possibly

other

exceptions.


Cross-site scripting (XSS) vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to inject arbitrary web script or HTML via the cID parameter in a document action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Kmita Gallery allow remote attackers to inject arbitrary web script or HTML via the (1) begin parameter to index.php and the (2) searchtext parameter to search.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 10.0 MP1 9.2 MP3 9.1 9.0 8.1 SP6 7.0 and SP7 allows remote attackers to affect confidentiality integrity and availability related to WLS. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is cross-site scripting.


Cross-site scripting (XSS) vulnerability in the Silva Find extension 1.1.5 and earlier in Silva 1.x before 1.6.3.2 Silva 2.0 before 2.0.12.2 and Silva 2.1 before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the fulltext parameter.


Cross-site scripting (XSS) vulnerability in Hitachi Groupmax Web Workflow SDK Set for Active Server Pages before 06-52-/C and Hitachi Groupmax Workflow - Development Kit for Active Server Pages before 06-52-/A allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 Thunderbird 2.x before 2.0.0.19 and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy and conduct cross-site scripting (XSS) attacks via an XBL binding to an \unloaded document.\


Multiple cross-site scripting (XSS) vulnerabilities in Fujitsu-Siemens WebTransactions 7.0 7.1 and possibly other versions allow remote attackers to inject arbitrary web script or HTML via vectors associated with (1) a demo application shipped with WebTransactions and possibly (2) an unspecified \dynamic application.\


Cross-site scripting (XSS) vulnerability in the XSS filter (framework/Text_Filter/Filter/xss.php) in Horde Application Framework 3.2.2 and 3.3 when Internet Explorer is being used allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to style attributes.


Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter a different vector than CVE-2008-2751.


Cross-site scripting (XSS) vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4 a module for Drupal allows remote authenticated users with \administer taxonomy\ permissions to inject arbitrary web script or HTML via a Newsletter category field.


Multiple cross-site scripting (XSS) vulnerabilities in Kerio MailServer before 6.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) folder parameter to mailCompose.php or the (2) daytime parameter to calendarEdit.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) Testproject Names and (2) Testplan Names in planEdit.php and possibly (3) Testcaseprefixes in projectview.tpl.


Multiple cross-site scripting (XSS) vulnerabilities in the web-based interface in IBM Metrica Service Assurance Framework allow remote authenticated users to inject arbitrary web script or HTML via (1) the elementid parameter in a generatedreportresults action to the ReportTree program (2) the jnlpname parameter to the Launch program or (3) the :tasklabel parameter to the ReportRequest program related to the name of a report.


Cross-site scripting (XSS) vulnerability in Hitachi JP1/Integrated Management - Service Support 08-10 through 08-10-05 08-11 through 08-11-03 and 08-50 through 08-50-03 on Windows allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in login.php in myPHPscripts Login Session 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) ls_user and (2) ls_email parameters (aka the User form) in an ls_register action. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allow remote attackers to inject arbitrary web script or HTML via (1) the mod parameter to the default URI; (2) the foto parameter to photo.php in the 05_Foto module; or (3) the name parameter in an insertrecord action to index.php in the 08_Files module as demonstrated by injection within a SRC attribute of an IFRAME element.


Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy inject content into documents associated with other domains and conduct cross-site scripting (XSS) attacks via unknown vectors related to restoration of SessionStore data.


Multiple cross-site scripting (XSS) vulnerabilities in Xerox DocuShare 6 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) SearchResults/ and (2) Services/ in dsdn/dsweb/ and (3) the default URI under unspecified docushare/dsweb/ServicesLib/Group-#/ directories.


Multiple cross-site scripting (XSS) vulnerabilities in PHPepperShop 1.4 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php or (2) shop/kontakt.php or (3) shop_kunden_mgmt.php or (4) SHOP_KONFIGURATION.php in shop/Admin/.


Multiple cross-site scripting (XSS) vulnerabilities in MODx before 0.9.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the preserveUrls function and (2) \username input.\ NOTE: vector 2 may be related to CVE-2008-5939.


Multiple cross-site scripting (XSS) vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) a message (2) a milestone or (3) a display name in a profile or the (4) a or (5) c parameter to index.php.


Cross-site scripting (XSS) vulnerability in search.php in Kmita Catalogue 2.x allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18 allows remote attackers to violate the same origin policy to conduct cross-site scripting (XSS) attacks and execute arbitrary JavaScript with chrome privileges via unknown vectors.


Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected but this is probably incorrect based on the original disclosure.


Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary web script or HTML via a (1) MTEntryAuthorUsername (2) MTAuthorDisplayName (3) MTEntryAuthorDisplayName or (4) MTCommenterName field in a Profile View template; a (5) listing screen or (6) edit screen in the CMS app; (7) a TrackBack title related to the HTML sanitization library; or (8) a user archive name (aka archive title) on a published Community Blog template.


Cross-site scripting (XSS) vulnerability in the profile editing functionality in Injader before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in login.asp in Nightfall Personal Diary 1.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter and possibly other \login fields.\ NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allows remote attackers to inject arbitrary web script or HTML via the name parameter in an updaterecord action to index.php in the 08_Files module. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in IBM Workplace Content Management (WCM) 6.0G and 6.1 before CF8 when a Page Navigation Component shows menu entries allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in the URI related to parameters \not being encoded.\


Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino allow remote attackers to inject arbitrary web script or HTML via unspecified vectors possibly related to qpconfig_sample.xml aka SPR CWIR7KMPVP and THES7F9NVR a different vulnerability than CVE-2008-2163 and CVE-2008-3860.


Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string which is not properly escaped before storage in the History Search database (aka md.dat) a different vector than CVE-2008-4696. NOTE: some of these issues were addressed before 9.60.


Cross-site scripting (XSS) vulnerability in search.php in Ed Pudol Clickbank Portal allows remote attackers to inject arbitrary web script or HTML via the search box. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in EC-CUBE Ver2 2.1.2a and earlier EC-CUBE Ver2 Beta(RC) 2.2.0-beta and earlier and EC-CUBE Community Edition Nighly-Build r17623 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different issue than CVE-2008-4536 and CVE-2008-4537.


Cross-site

scripting

(XSS)

vulnerability

in

in

Tribiq

CMS

when

is

enabled

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter.

NOTE:

the

provenance

of

this

information

is

unknown;

the

details

are

obtained

solely

from

third

party

information.


Cross-site scripting (XSS) vulnerability in imp/test.php in Horde Turba Contact Manager H3 2.2.1 and other versions before 2.3.1 and possibly other Horde Project products allows remote attackers to inject arbitrary web script or HTML via the User field in an IMAP session.


Cross-site scripting (XSS) vulnerability in Movable Type (MT) 4.x through 4.20 and 3.36 and earlier; Movable Type Enterprise 4.x through 4.20 and 1.54 and earlier; and Movable Type Community Solution allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the web server component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 allows remote attackers to inject arbitrary web script or HTML via the request URL which is not properly handled in a 404 web error page.


Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.5.94 allow remote attackers to inject arbitrary web script or HTML via (1) the j_username parameter to j_acegi_security_check (2) the username parameter to notification/list.jsp and (3) the filter parameter to event/list.


Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2 Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from JavaScript code before execution aka \Stripped BOM characters bug.\


Cross-site scripting (XSS) vulnerability in bidhistory.php in iTechBids Gold 5.0 allows remote attackers to inject arbitrary web script or HTML via the item_id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in surveyresults.asp in Smart Survey 1.0 allows remote attackers to inject arbitrary web script or HTML via the sid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in index.php in Elxis CMS 2008.1 revision 2204 allows remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO or the (2) option (3) Itemid (4) id (5) task (6) bid and (7) contact_id parameters. NOTE: the error might be located in modules/mod_language.php and index.php might be the interaction point.


Cross-site scripting (XSS) vulnerability in Cisco Unity 4.x before 4.2(1)ES162 5.x before 5.0(1)ES56 and 7.x before 7.0(2)ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database (aka data store).


Cross-site scripting (XSS) vulnerability in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openid_trust_root parameter and an inconsistent openid_return_to parameter which is not properly handled in an error message.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the community title (2) API input and vectors related to the (3) Homepage (4) Blogs (5) Profiles (6) Dogear (7) Activities and (8) Global Search components. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in search.php in Dan Fletcher Recipe Script allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in fichiers/add_url.php in Logz CMS 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the art parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in ap-pages.php in Atarone CMS 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) id parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Google Chrome 0.2.149.30 allow remote attackers to inject arbitrary web script or HTML via an ftp:// URL for an HTML document within a (1) JPG (2) PDF or (3) TXT file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in adodb.php in XAMPP for Windows 1.6.8 allows remote attackers to inject arbitrary web script or HTML via the (1) dbserver (2) host (3) user (4) password (5) database and (6) table parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the Mailsave module 5.x before 5.x-3.3 and 6.x before 6.x-1.3 a module for Drupal allows remote attackers to inject arbitrary web script or HTML via an e-mail message with an attached file that has a modified Content-Type.


Cross-site scripting (XSS) vulnerability in gallery.inc.php in Planetluc MyGallery 1.7.2 and earlier and possibly other versions before 1.8.1 allows remote attackers to inject arbitrary web script or HTML via the mghash parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php.


Multiple cross-site scripting (XSS) vulnerabilities in @Mail 5.42 allow remote attackers to inject arbitrary web script or HTML via the (1) file and (2) HelpFile parameters to parse.php the (3) Folder and (4) start parameters to showmail.php and the (5) abookview parameter to abook.php.


Cross-site scripting (XSS) vulnerability in search.php in Datafeed Studio 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results as demonstrated using the onerror Javascript even in an IMG tag.


Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identifier (aka the \optional fragment\) which is not properly escaped before storage in the History Search database (aka md.dat).


Mozilla Firefox 2.0.0.14 and other versions before 2.0.0.17 allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser as demonstrated by a \jav&#56325ascript\ sequence aka \HTML escaped low surrogates bug.\


Cross-site

scripting

(XSS)

vulnerability

in

in

Kayako

eSupport

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

jsMakeSrc

parameter.

NOTE:

the

provenance

of

this

information

is

unknown;

the

details

are

obtained

solely

from

third

party

information.

NOTE:

this

issue

is

probably

in

the

HTMLArea

HTMLTidy

(HTML

Tidy)

plugin

not

eSupport.


Cross-site scripting (XSS) vulnerability in index.php in Domain Group Network GooCMS 1.02 allows remote attackers to inject arbitrary web script or HTML via the s parameter in a comments action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0 and possibly other versions including 2.11.9.2 and 3.0.1 when register_globals is enabled allows remote attackers to inject arbitrary web script or HTML via the db parameter a different vector than CVE-2006-6942 and CVE-2007-5977.


Cross-site

scripting

(XSS)

vulnerability

in

Bitweaver

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

URL

parameter

to

edit.php

and

list.php

in

articles/;

and

rankings.php

in

blogs/;

calendar/index.php;

calendar.php

index.php

and

in

events/;

index.php

and

in

fisheye/;

newsletters/edition.php;

pigeonholes/list.php;

recommends/index.php;

rss/index.php;

stars/index.php;

and

stats/index.php

different

vectors

than

and

NOTE:

the

provenance

of

this

information

is

unknown;

the

details

are

obtained

solely

from

third

party

information.


Cross-site scripting (XSS) vulnerability in EC-CUBE Ver1 1.4.6 and earlier Ver1 Beta 1.5.0-beta and earlier Ver2 2.1.2a and earlier Ver2 Beta(RC) 2.2.0-beta and earlier Community Edition 1.3.4 and earlier and Community Edition Nightly-Build r17319 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different issue than CVE-2008-4535 and CVE-2008-4537.


Cross-site scripting (XSS) vulnerability in the Bookmarks plugin in Brim 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in an addItemPost action to index.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in (1) Tor World Tor Board 1.3 and earlier (2) Topics BBS 1.11 and earlier (3) Simple BBS 1.86 and earlier and (4) Interactive BBS 1.57 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different issue than CVE-2008-0917.


Cross-site scripting (XSS) vulnerability in index.php in Simple PHP Scripts gallery 0.1 0.3 and 0.4 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45 and other versions including versions later than 5.0.45 when the --html option is enabled allows attackers to inject arbitrary web script or HTML by placing it in a database cell which might be accessed by this client when composing an HTML document. NOTE: as of 20081031 the issue has not been fixed in MySQL 5.0.67.


Cross-site scripting (XSS) vulnerability in index.php in webCMS Portal Edition allows remote attackers to inject arbitrary web script or HTML via the patron parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1 as used in SonicWALL Pro 2040 and TZ 180 and 190 allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering which is not properly handled in the CFS block page aka \universal website hijacking.\


Cross-site scripting (XSS) vulnerability in the contact update page (ss/bwgkoemr.P_UpdateEmrgContacts) in SunGard Banner Student 7.3 allows remote attackers to inject arbitrary web script or HTML via the addr1 parameter. NOTE: this might be resultant from a CSRF vulnerability but there are insufficient details to be sure.


Cross-site scripting (XSS) vulnerability in EC-CUBE Ver1 1.4.6 and earlier Ver1 Beta 1.5.0-beta and earlier Ver2 2.1.2a and earlier Ver2 Beta(RC) 2.1.1-beta and earlier Community Edition 1.3.4 and earlier and Community Edition Nightly-Build r17336 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different issue than CVE-2008-4535 and CVE-2008-4536.


Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a \Content-Disposition: attachment\ header and is accessed through a cdo: URL which renders the content instead of raising a File Download dialog box aka \Vulnerability in Content-Disposition Header Vulnerability.\


Cross-site scripting (XSS) vulnerability in search.php in Siteman 1.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in search_results.php in buymyscripts Lyrics Script allows remote attackers to inject arbitrary web script or HTML via the k parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in complete.php in Simple PHP Scripts blog 0.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the RMSOFT Downloads Plus (rmdp) module 1.5 and 1.7 for Xoops allow remote attackers to inject arbitrary web script or HTML via the (1) key parameter to search.php and the (2) id parameter to down.php.


Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 3.0.1 through 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an ftp:// URL for an HTML document within a (1) JPG (2) PDF or (3) TXT file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2 when Internet Explorer is used allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a \</script\ sequence.


The links panel in Opera before 9.62 processes Javascript within the context of the \outermost page\ of a frame which allows remote attackers to inject arbitrary web script or HTML via cross-site scripting (XSS) attacks.


The Fast Forward feature in Opera before 9.61 when a page is located in a frame executes a javascript: URL in the context of the outermost page instead of the page that contains this URL which allows remote attackers to conduct cross-site scripting (XSS) attacks.


Cross-site scripting (XSS) vulnerability in admin/login.php in Matterdaddy Market 1.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to inject arbitrary web script or HTML via (1) the fn parameter during a dload action (2) the mask parameter during a search action and (3) the tab parameter during a sysinfo action.


Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) replytotext (2) quotetext (3) originallypostedby (4) sep (5) maxtags (6) tagsep (7) tagheadersep (8) taglabel and (9) tagheaderlabel parameters.


Cross-site scripting (XSS) vulnerability in IBM Workplace for Business Controls and Reporting 2.x and IBM Workplace Web Content Management 6.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) controller files created by Techsmith Camtasia Studio before 5 allows remote attackers to inject arbitrary additional SWF content via a URL in the csPreloader parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 before 5.7.1 5.6 before 5.6.1 and 5.4 before 5.4.3 allow remote attackers to inject arbitrary web script or HTML via (1) the mv_order_item CGI variable parameter in Core (2) the country-select widget or (3) possibly the value specifier when used in the UserTag feature.


Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp (2) updatedir (3) scriptpath_show (4) domain_show (5) thispage (6) thisapp and (7) currentversion parameters in an Upgrade action.


Multiple cross-site scripting (XSS) vulnerabilities in GEDCOM_TO_MYSQL 2 allow remote attackers to inject arbitrary web script or HTML via the (1) nom_branche and (2) nom parameters to php/prenom.php; the (3) nom_branche parameter to php/index.php; and the (4) nom_branche (5) nom and (6) prenom parameters to php/info.php.


Cross-site scripting (XSS) vulnerability in index.php in Extrakt Framework 0.7 allows remote attackers to inject arbitrary web script or HTML via the pluginsfileid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) mytable parameter to view.php (2) mytable parameter to viewdb2.php (3) tablehere parameter to category-rename.php and (4) letter parameter to module-contacts.php.


Multiple cross-site scripting (XSS) vulnerabilities in TGS Content Management 0.3.2r2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg and (2) goodmsg parameters to (a) login.php and (b) index.php and the (3) dir and (4) id parameters to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web script or HTML via the step parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in PHPFreeForum 1.0 RC2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to error.php and the (2) nickname and (3) randomid parameters to part/menu.php.


Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in jax_linklists.php in Jack (tR) Jax LinkLists 1.00 allows remote attackers to inject arbitrary web script or HTML via the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname (Full Name) parameter in the ViewProfile page or (2) returnUrl parameter in a form as demonstrated using secure/AddComment!default.jspa (aka \Add Comment\).


Multiple cross-site scripting (XSS) vulnerabilities in Gallarific Free Edition allow remote attackers to inject arbitrary web script or HTML via (1) the e-mail address (2) a comment which is not properly handled during moderation and (3) the tag parameter to gallery/tags.php.


Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo Gallery (aka Ezphotogallery) 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) galleryid parameter to gallery.php and the (2) size or (3) imageid parameters to show.php.


Cross-site scripting (XSS) vulnerability in as_archives.php in phpAdultSite CMS possibly 2.3.2 allows remote attackers to inject arbitrary web script or HTML via the results_per_page parameter to index.php. NOTE: some of these details are obtained from third party information. NOTE: this issue might be resultant from a separate SQL injection vulnerability.


Multiple cross-site scripting (XSS) vulnerabilities in Camera Life 2.6.2b8 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.php and (2) rss.php; the query string after the image name in (3) photos/photo; the path parameter to (4) folder.php; page parameter and REQUEST_URI to (5) login.php; ver parameter to (6) media.php; theme parameter to (7) modules/iconset/iconset-debug.php; and the REQUEST_URI to (8) index.php.


Multiple cross-site scripting (XSS) vulnerabilities in QuickerSite 1.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the close parameter to showThumb.aspx; (2) SB_redirect and (3) SB_feedback parameters in process_send.asp as reachable through default.asp; (4) paramCode and (5) cColor parameters to picker.asp; and the (6) query string (7) Referer header and (8) X-FORWARDED-FOR header to rss.asp.


Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by InfoSoft FusionCharts allows remote attackers to inject arbitrary additional SWF content via a URL in the SRC attribute of an IMG element in the dataURL parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbitrary web script or HTML via the (1) radio parameter to showcategory.php (2) msg parameter to advertisers/signinform.php (3) radio parameter to gallery.php (4) msg parameter to lostpassword.php (5) radio parameter to showcategory.php (6) msg parameter to admin/adminhome.php and (7) msg parameter to admin/index.php. NOTE: a different signinform.php file is already covered by CVE-2008-6306.


Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5.7 and earlier allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) the title and description parameters to the com_weblinks module and (2) unspecified vectors in the com_content module related to \article submission.\


Cross-site scripting (XSS) vulnerability in admin.php in Php-Stats 0.1.9.1 allows remote attackers to inject arbitrary web script or HTML via the (1) sel_mese and (2) sel_anno parameters in a systems action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in search.php in Zoph 0.7.2.1 allows remote attackers to inject arbitrary web script or HTML via the _off parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) \ (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

GraFX

miniCWB

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

errcontext

and

parameters.


Cross-site scripting (XSS) vulnerability in signinform.php in Softbiz Classifieds Script allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the administrative interface in Drupal Content Construction Kit (CCK) 5.x before 5.x-1.10 and 6.x before 6.x-2.0 a module for Drupal allows remote authenticated users with \administer content\ permissions to inject arbitrary web script or HTML via (1) field labels and (2) content-type names.


Multiple cross-site scripting (XSS) vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) page and (2) query parameters to (a) index.php (3) cat and (4) file parameters to (b) download.php (5) gal parameter to gallery.php and the (6) URL to admin/login.php.


The CGI framework in Kaya 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting (XSS) attacks via unspecified vectors.


Cross-site scripting (XSS) vulnerability in glossaire.php in Glossaire 2.0 allows remote attackers to inject arbitrary web script or HTML via the letter parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbitrary web script or HTML via the rank_title parameter. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML via the (1) author_name (2) itemtitle and (3) item parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by Adobe Dreamweaver when the Insert Flash Video feature is used allows remote attackers to inject arbitrary web script or HTML via an asfunction: URI in the skinName parameter. NOTE: this may overlap CVE-2007-6242 CVE-2007-6244 or CVE-2007-6637.


Cross-site scripting (XSS) vulnerability in manageproject.php in Collabtive 0.4.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via the project Name which is not properly handled when the administrator performs an editform action related to admin.php.


Multiple cross-site scripting (XSS) vulnerabilities in register.php in eSyndiCat Directory 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) username (2) email (3) password (4) password2 (5) security_code and (6) register parameters.


Multiple cross-site scripting (XSS) vulnerabilities in WikyBlog before 1.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) key parameter to index.php/Special/Main/keywordSearch (2) revNum parameter to index.php/Edit/Main/Home (3) to parameter to index.php/Special/Main/WhatLinksHere (4) user parameter to index.php/Special/Main/UserEdits and (5) the PATH_INFO to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) user parameter in a sendmessage action and the (2) username parameter when registering a new user different vectors than CVE-2008-0679.


Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with \administer content\ permissions to inject arbitrary web script or HTML via the (1) \field label \ (2) \help text \ or (3) \allowed values\ settings.


Multiple cross-site scripting (XSS) vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to (1) admin.php (2) index.php (3) sess.php (4) stats.php (5) detail.php (6) resize.php and (7) show.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in World Recipe 2.11 allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to emailrecipe.aspx (2) id parameter to recipedetail.aspx and the (3) catid parameter to validatefieldlength.aspx.


Cross-site scripting (XSS) vulnerability in function.php in Zenphoto 1.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the \request logging\ feature. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in dispatch.php in Achievo 1.3.2 allows remote attackers to inject arbitrary web script or HTML via the atkaction parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Kronos

webTA

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

description

field

to

servlet/com.threeis.webta.H710selProject

and

servlet/com.threeis.webta.H720editProjectInfo.

NOTE:

states

that

the

initial

report

was

incorrect

but

the

reason

for

this

conclusion

is

unknown.


Cross-site scripting (XSS) vulnerability in Juniper NetScreen ScreenOS before 5.4r10 6.0r6 and 6.1r2 allows remote attackers to inject arbitrary web script or HTML via the user name parameter to the (1) web interface login page or the (2) telnet login page.


Cross-site scripting (XSS) vulnerability in refbase before 0.9.5 allows remote attackers to inject arbitrary web script or HTML via the headerMsg parameter to (1) show.php and (2) search.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in BMForum 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) outpused parameter to index.php the (2) footer_copyright and (3) verandproname parameters to newtem/footer/bsd01footer.php and the (4) topads and (5) myplugin parameters to newtem/header/bsd01header.php.


Multiple cross-site scripting (XSS) vulnerabilities in the WEC Discussion Forum (wec_discussion) extension 1.7.0 and earlier for TYPO3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors a different issue than CVE-2008-3029.


Multiple cross-site scripting (XSS) vulnerabilities in phpSQLiteCMS 1 RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) langhome (2) langadmin_menu and (3) langadmin_menu_page_overview parameters to cms/includes/header.inc.php; and the (4) langlogin_username and (5) langlogin_password parameters to cms/includes/login.inc.php.


Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy \no database\ (aka flat) version 1.2.2 and possibly SQLite version 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) index.php and (2) LightNEasy.php.


Cross-site scripting (XSS) vulnerability in seeurl.php in Xavier Flahaut URLStreet 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) language (2) order and (3) filter parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Squid Analysis Report Generator (Sarg) 2.2.4 allows remote attackers to inject arbitrary web script or HTML via a JavaScript onload event in the User-Agent header which is not properly handled when displaying the Squid proxy log. NOTE: this issue exists because of an incomplete fix for CVE-2008-1168.


Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate Premium allow remote attackers to inject arbitrary web script or HTML via the blog possibly the (1) Title and (2) Text fields; (3) the gallery possibly the Description field in Your Pictures; (4) the forum possibly the Your Message field when posting a new thread; or (5) the vote parameter in a view action to index.php. NOTE: some of these details are obtained from third party information.