Cross-site scripting (XSS) vulnerability in IBM Eclipse Help System (IEHS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0 through 7.0.0.2 CF27 and 8.0 before 8.0.0.1 CF06 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Service Automation Manager 7.2.2.2 before 7.2.2.2-TIV-TSAM-LA0041 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) REST API or (2) Self Service UI.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140321-1336 and Tivoli IT Asset Management for IT Tivoli Service Request Manager Maximo Service Desk and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.20140218-1510 allows remote authenticated users to inject arbitrary web script or HTML via an attachment URL.


Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.


Cross-site scripting (XSS) vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6 and Rational DOORS Next Generation 4.x before 4.0.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in googlemap.jsp in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0 through 7.0.0.2 CF28 and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted text value.


Ember.js 1.0.x before 1.0.1 1.1.x before 1.1.3 1.2.x before 1.2.1 1.3.x before 1.3.1 and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application using the \{{group}}\ Helper and a crafted payload.


Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1 10.1 before IF6 10.1.1 before IF5 10.2 before IF7 10.2.1 before IF4 and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter that is not properly handled during use of the Back button.


Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux Adobe AIR before 14.0.0.110 Adobe AIR SDK before 14.0.0.110 and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2014-0531 and CVE-2014-0533.


Cross-site scripting (XSS) vulnerability in boot_config.jsp in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF28 7.0 through 7.0.0.2 CF28 and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to inject arbitrary web script or HTML via the (1) ADDNewDomain parameter to parental/website-filters.asp or (2) VmTracerouteHost parameter to goform/status/diagnostics-route.


Cross-site scripting (XSS) vulnerability in the web interface on Huawei Echo Life HG8247 routers with software before V100R006C00SPC127 allows remote attackers to inject arbitrary web script or HTML via an invalid TELNET connection attempt with a crafted username that is not properly handled during construction of the \failed log-in attempts over telnet\ log view.


Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11 2.4.x before 2.4.10 2.5.x before 2.5.6 and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements related to a \cross-frame scripting\ issue.


Cross-site scripting (XSS) vulnerability in the Social Rendering implementation in the IBM Connections integration in IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 13 9.0.1 before Update 12 9.0.2 before Update 7 10 before Update 14 and 11 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl (2) templates_internal/home.tpl or (3) templates_internal/entries.tpl; (4) an event field to objects.php; or the (5) email or (6) nickname field to pages.php related to templates_internal/users.tpl.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8 6.x and 7.1 through 7.1.1.2 and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8 7.1 through 7.1.1.2 and 7.2 for Tivoli Asset Management for IT and certain other products allow remote authenticated users to inject arbitrary web script or HTML via (1) the KPI display name field or (2) a portlet field.


Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2014-0941.


Multiple cross-site scripting (XSS) vulnerabilities in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to inject arbitrary web script or HTML via (1) the Message parameter to rcore6/main/showerror.jsp (2) the ButtonsetClass parameter to rcore6/main/buttonset.jsp (3) the MBName parameter to rcore6/frameset.jsp (4) the Init parameter to algopds/rcore6/main/browse.jsp or the (5) Name (6) StoreName or (7) STYLESHEET parameter to algopds/rcore6/main/ibrowseheader.jsp.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6 Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management for IT and Maximo Service Desk allows remote authenticated users to inject arbitrary web script or HTML via the Query Description Field.


Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2 1.3.x before 1.3.2 and 1.4.x before 1.4.0-beta.6 when used in non-block form allows remote attackers to inject arbitrary web script or HTML via the title attribute.


Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2 SonicWALL Analyzer before 7.1 SP2 and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a ScreenDisplayManager genNetwork action.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite) as used in Atlas eDiscovery Process Management through 6.0.3 Disposal and Governance Management for IT through 6.0.3 and Global Retention Policy and Schedule Management through 6.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.


Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux Adobe AIR before 14.0.0.110 Adobe AIR SDK before 14.0.0.110 and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2014-0531 and CVE-2014-0532.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27 6.1.5.0 through 6.1.5.3 CF27 7.0.0 through 7.0.0.2 CF28 and 8.0.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2 3.3.1 before 3.3.1.3 3.3.2 before 3.3.2.2 and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in the WP RESTful plugin 0.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) oauth_callback parameter to html_api_authorize.php or the (2) oauth_token_temp or (3) oauth_callback_temp parameter to html_api_login.php.


Cross-site scripting (XSS) vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to inject arbitrary web script or HTML via the hostname in a DHCP request.


Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a user description. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the Custom Meta module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the \administer custom meta settings\ permission to inject arbitrary web script or HTML via the (1) attribute or (2) content value for a meta tag.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.x through 6.1.0.47 7.0 before 7.0.0.35 8.0 before 8.0.0.10 and 8.5 before 8.5.5.4 allows remote authenticated administrators to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables.


Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the starttime0 parameter to firewall_schedule.php (2) the rssfeed parameter to rss.widget.php (3) the servicestatusfilter parameter to services_status.widget.php (4) the txtRecallBuffer parameter to exec.php or (5) the HTTP Referer header to log.widget.php.


Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

through

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

URI

used

for

reaching

or

leading

to

improper

handling

within

an

http-equiv=\refresh\

META

element.


Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng parameter to snort_import_aliases.php or (2) unspecified variables to snort_select_alias.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

paginas/vista-previa-form.php

in

the

EnvialoSimple:

Email

Marketing

and

Newsletters

(envialosimple-email-marketing-y-newsletters-gratis)

plugin

before

for

WordPress

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

FormID

or

AdministratorID

parameter.


Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Video Presentation plugin before 3.31 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) room_name parameter to c_login.php or (2) room parameter to index.php in vp/.


Multiple cross-site scripting (XSS) vulnerabilities in forms/search.php in the WP-Business Directory (wp-ttisbdir) plugin 1.0.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit (2) search_term (3) page_id (4) page or (5) page_links parameter.


Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) api_key (2) payment_page_url (3) merchant_id (4) api_url or (5) currency parameter.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Epicor

Enterprise

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

Notes

section

to

Order

details;

Description

section

to

\Order

to

consume\;

Favorites

name

section

to

Favorites;

FiltKeyword

parameter

to

Act

parameter

to

hdnOpener

or

hdnApproverFieldName

parameter

to

or

INTEGRATED

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8 as used in Horde Groupware Webmail Edition before 5.1.5 allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.


Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE (2) EMAIL or (3) NAME parameter.


Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message.


Cross-site scripting (XSS) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Performance Management - Manager Web Option 07-00 through 07-54 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field (3) passwd1 field (4) passwd2 field or (5) do parameter to account.php.


Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) vp (2) vs (3) l (4) vu or (5) vm parameter.


Cross-site scripting (XSS) vulnerability in breakOutWithName.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2 3.3.1 before 3.3.1.3 3.3.2 before 3.3.2.2 and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

tests/notAuto_test_ContactService_pauseCampaign.php

in

the

Infusionsoft

Gravity

Forms

plugin

before

for

WordPress

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

go

contactId

or

campaignId

parameter.


Multiple cross-site scripting (XSS) vulnerabilities in event/index2.do in ManageEngine EventLog Analyzer before 9.0 build 9002 allow remote attackers to inject arbitrary web script or HTML via the (1) width (2) height (3) url (4) helpP (5) tab (6) module (7) completeData (8) RBBNAME (9) TC (10) rtype (11) eventCriteria (12) q (13) flushCache or (14) product parameter. Fixed in Build 11072.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.


Cross-site scripting (XSS) vulnerability in tpls/editmedia.php in the Hot Files: File Sharing and Download Manager (wphotfiles) plugin 1.0.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mediaid parameter.


Multiple cross-site scripting (XSS) vulnerabilities in yupdates_application.php in the Yahoo! Updates for WordPress plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) secret (2) key or (3) appid parameter.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

wp-football

plugin

and

earlier

for

WordPress

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

league

parameter

to

or

templates/template_worldCup_preview.php;

the

f

parameter

to

football-functions.php;

the

id

parameter

in

an

\action\

action

to

or

or

the

parameter

in

a

delete

action

to


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Cacti

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

cdef.php

graphs.php

host.php

or

or

the

or

parameter

to


Cross-site scripting (XSS) vulnerability in Content Navigator in Content Engine in IBM FileNet Content Manager 5.2.x before 5.2.0.3-P8CPE-IF003 and Content Foundation 5.2.x before 5.2.0.3-P8CPE-IF003 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

NICE

Recording

eXpress

(aka

Cybertech

eXpress)

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

USRLNM

parameter

to

myaccount/mysettings.edit.validate.asp

or

the

frame

parameter

to

iframe.picker.statchannels.asp

iframe.picker.channelgroups.asp

iframe.picker.extensions.asp

iframe.picker.licenseusergroups.asp

iframe.picker.licenseusers.asp

iframe.picker.lookup.asp

or

iframe.picker.marks.asp

in


Cross-site scripting (XSS) vulnerability in GanttProjectSchedulerPopup.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2 3.3.1 before 3.3.1.3 3.3.2 before 3.3.2.2 and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site

scripting

(XSS)

vulnerability

in

in

FCKeditor

before

and

earlier

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

an

array

key

in

the

textinputs

parameter

a

different

issue

than


Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55 as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.


Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) theme or (2) playlistmod parameter.


Cross-site scripting (XSS) vulnerability in tmui/dashboard/echo.jsp in the Configuration utility in F5 BIG-IP LTM APM ASM GTM and Link Controller 11.0.0 before 11.6.0 and 10.1.0 through 10.2.4 AAM 11.4.0 before 11.6.0 AFM and PEM 11.3.0 before 11.6.0 Analytics 11.0.0 through 11.5.1 Edge Gateway WebAccelerator and WOM 11.0.0 through 11.3.0 and 10.1.0 through 10.2.4 and PSM 11.0.0 through 11.4.1 and 10.1.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings plugin before 2.0.25 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a ratings shortcode and a unique ID. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in FortiGuard FortiWeb 5.0.x 5.1.x and 5.2.x before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) user/ldap_user/check_dlg or (2) user/radius_user/check_dlg.


Cross-site

scripting

(XSS)

vulnerability

in

in

the

Spotlight

(spotlightyour)

plugin

and

earlier

for

WordPress

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

paymentType

parameter.


Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x through 2.0.1.1 3.x before 3.0.1.6 iFix 4 4.x before 4.0.7 iFix 2 and 5.x before 5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) customername parameter to central/orders/searchcriteria.action; (2) productname (3) availability or (4) status parameter to central/catalog/productlist.action; or unspecified vectors in (5) WebContent/orders/orderlist.jsp.


Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) promo_type (2) fb_edit_action or (3) promo_id parameter.


Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.


Cross-site scripting (XSS) vulnerability in res/fake_twitter/frame.php in the \verwei.se - WordPress - Twitter\ (verweise-wordpress-twitter) plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter.


Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) plugin 3.1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.


Cross-site scripting (XSS) vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013 9.7 before 9.7.093013 10.0 before 10.0.093013 and 10.1 before 10.1.093013 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) resources.js or (2) resources.css in ajenti:static/ related to the traceback page.


Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page.


Multiple cross-site scripting (XSS) vulnerabilities in (1) search_ajax.tpl and (2) search_ajax_small.tpl in templates/default/tpl/module_search/ in the Search module (module_search) in Kajona before 4.5 allow remote attackers to inject arbitrary web script or HTML via the search parameter.


Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) tags or (2) search_for parameter.


Multiple cross-site scripting (XSS) vulnerabilities in the WP GuestMap plugin 1.8 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) zl (2) mt or (3) dc parameter to guest-locator.php; the (4) zl (5) mt (6) activate or (7) dc parameter to online-tracker.php; the (8) zl (9) mt or (10) dc parameter to stats-map.php; or the (11) zl (12) mt (13) activate or (14) dc parameter to weather-map.php.


Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in payper/payper.php in the Pay Per Media Player plugin 1.24 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fcolor (2) links (3) stitle (4) height (5) width (6) host (7) bcolor (8) msg (9) id or (10) size parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8 as used in Horde Groupware Webmail Edition before 5.1.5 allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Openfiler

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

TinkerAjax

parameter

to

uptime.html

or

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

MaxInstances

PassivePorts

Port

ServerName

TimeoutLogin

TimeoutNoTransfer

or

TimeoutStalled

parameter

to

the

or

parameter

to

admin/system.html;

the

newTgtName

parameter

to

the

User-Agent

HTTP

header

to

language.html

login.html

or

password.html

in

account/;

or

the

User-Agent

HTTP

header

to

services.html

or

in

admin/.


Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit (2) order_direction (3) limit_start (4) id or (5) order parameter.


Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in a dev.Empty action to nps/servlet/webacc (2) the error parameter to nidp/jsp/x509err.jsp (3) the lang parameter to sslvpn/applet_agent.jsp or (4) the secureLoggingServersA parameter to roma/system/cntl a different issue than CVE-2014-9412.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

LimeSurvey

Build

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

pid

attribute

to

the

function

to

in

CPDB

the

sa

parameter

to

or

a

crafted

CSV

file

to

the

\Import

CSV\

functionality.


Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the \a\ parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression.


Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name (4) Data Input Method Name or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Name in a delete or (9) duplicate action.


Multiple cross-site scripting (XSS) vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) a_country parameter in a process action to affiliate_signup.php or (2) entry_country_id parameter in an edit action to admin/create_account.php.


Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2 when Multisite is enabled allows remote authenticated administrators to inject arbitrary web script or HTML and obtain Super Admin privileges via a crafted avatar URL.


Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username (2) first name or (3) last name in a (a) create or (b) edit user action.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

WeBid

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

in

a

first

action

to

register.php

or

the

username

parameter

in

a

login

action

to


Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Schrack Technik microControl with firmware 1.7.0 (937) allow remote attackers to inject arbitrary web script or HTML via the position textbox in the configuration menu or other unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the multisite component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the (1) render_status_icons function in htmllib.py or (2) ajax_action function in actions.py.


Multiple cross-site scripting (XSS) vulnerabilities in test.php in Visualware MyConnection Server 9.7i allow remote attackers to inject arbitrary web script or HTML via the (1) testtype (2) ver (3) cm (4) map (5) lines (6) pps (7) bpp (8) codec (9) provtext (10) provtextextra (11) provlink or (12) duration parameter.


Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page related to js/sql.js; (2) ENUM editor page related to js/functions.js; (3) monitor page related to js/server_status_monitor.js; (4) query charts page related to js/tbl_chart.js; or (5) table relations page related to libraries/tbl_relation.lib.php.


Cross-site scripting (XSS) vulnerability in php365.com 365 Links 3.11 and earlier 365 Links2 3.11 and earlier 365 Links+ 2.10 and earlier and 365 Links2+ 2.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 13 and Pro Advanced before 13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-3640.


Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php related to the survey resume.


Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.


Multiple cross-site scripting (XSS) vulnerabilities in Easy File Sharing (EFS) Web Server 6.8 allow remote authenticated users to inject arbitrary web script or HTML via the content parameter when (1) creating a topic or (2) posting an answer. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the (1) id_custom parameter in an amanmenu request or (2) id_game parameter in an alms/games/edit request to appCore/index.php.


Cross-site scripting (XSS) vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the \Content Type: Create new content\ permission to inject arbitrary web script or HTML via vectors related to the configuration.


Cross-site scripting (XSS) vulnerability in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via the tx_dmmjobcontrol_pi1searchkeyword parameter to jobs/.


Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php related to the button creation page.


Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the form_fields parameter in a (1) do_edit or (2) do_insert action to wp-admin/admin-ajax.php.


Cross-site scripting (XSS) vulnerability in the configuration UI in the Context Form Alteration module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the \administer contexts\ permission to inject arbitrary web script or HTML via unspecified vectors.


Cross-site

scripting

(XSS)

vulnerability

in

the

Custom

Search

module

before

and

before

for

Drupal

allows

remote

authenticated

users

with

the

\administer

custom

search\

permission

to

inject

arbitrary

web

script

or

HTML

via

the

\Label

text\

field

to

admin/config/search/custom_search/results.


Cross-site scripting (XSS) vulnerability in the login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00(AADY.4)C0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified \welcome message\ form data that is improperly handled during rendering of the loginMessage list item a different vulnerability than CVE-2014-7278.


Cross-site scripting (XSS) vulnerability in the output-page generator in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2014-7268.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4 4.1.x before 4.1.14.5 and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page related to libraries/TableSearch.class.php and libraries/Util.class.php.


webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area which allows remote authenticated users to upload files containing JavaScript and consequently conduct cross-site scripting (XSS) attacks by specifying the profile-picture area.


Cross-site scripting (XSS) vulnerability in ULTRAPOP.JP i-HTTPD allows remote attackers to inject arbitrary web script or HTML via a crafted string that is improperly rendered during construction of a directory index page a different vulnerability than CVE-2014-7263.


Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the poly_id parameter in an (1) edit_poly (2) edit_polyline or (3) edit_marker action in the wp-google-maps-menu page to wp-admin/admin.php.


Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help as used in HP Device Manager 6.x through 8.x before 8.1.2-00 HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00 HP XP P9000 Replication Manager 6.x and 7.x before 7.6.1-06 and HP XP7 Global Link Manager Software (aka HGLM) 6.x through 8.x before 8.1.2-00 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting (XSS) attacks or have unspecified other impact via crafted CSS as demonstrated by modifying MediaWiki:Common.css.


Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) form or (2) enc parameter in the CF7DBPluginShortCodeBuilder page to wp-admin/admin.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

the

Users

Management

feature

in

the

admin

component

in

Chyrp

before

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

user.email

or

user.website

field

in

a

user

registration.


Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11 2.5.x before 2.5.9 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the mod/feedback:mapcourse capability to provide a searchcourse parameter.


Cross-site scripting (XSS) vulnerability in the data-export feature in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2014-7267.


Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the \administer themes\ permission to inject arbitrary web script or HTML via the skip_link_text setting and unspecified other theme settings.


Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence 10.1 before IF10 10.1.1 before IF9 10.2 before IF11 10.2.1 before IF8 and 10.2.1.1 before IF7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site

scripting

(XSS)

vulnerability

in

IBM

Security

Network

Protection

and

devices

with

firmware

before

5.2.0.0-ISS-XGS-All-Models-Hotfix-FP0008

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors.


Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php which is not properly handled in a pngout error message.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 through 6.3.0.5 7.0.x through 7.0.0.5 7.5.x through 7.5.0.4 8.0.x before 8.0.0.3 and 8.5.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5 7.0.x through 7.0.0.5 7.5.x before 7.5.0.3 and 8.0.x before 8.0.0.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0.0 before 7.0.0.2 CF29 8.0.0 through 8.0.0.1 CF14 and 8.5.0 before CF03 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka \OWA XSS Vulnerability \ a different vulnerability than CVE-2014-6325.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 and 7.5.x before 7.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the HTTP User-Agent header.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0.0 through 7.0.0.2 CF29 8.0.0 through 8.0.0.1 CF14 and 8.5.0 before CF04 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in IBM Marketing Operations 7.x and 8.x before 8.5.0.7.2 8.6.x before 8.6.0.8 9.0.x before 9.0.0.4.1 9.1.0.x before 9.1.0.5 and 9.1.1.x before 9.1.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2 before EP26 6.0.4 before 6.0.4.5 iFix10 6.0.5 before 6.0.5.6 and 6.0.5.5a before 6.0.5.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) callback (2) dir or (3) extensions parameter in an addImages action to wp-admin/admin-ajax.php.


Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1 as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF) allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSphere Portal configuration leading to improper construction of a response page by an application.


Cross-site scripting (XSS) vulnerability in the Local Management Interface in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005 and Security Access Manager for Mobile 8.x before 8.0.0-ISS-ISAM-FP0005 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action or (2) nsextt parameter to oc-admin/index.php or the (3) nsextt parameter in an items_reported action to oc-admin/index.php.


Multiple cross-site scripting (XSS) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to inject arbitrary web script or HTML via an attribute in a (1) device name (2) device detail (3) report name (4) report detail or (5) portlet name or (6) a string to a helper method aka ZEN-15381 and ZEN-15410.


** DISPUTED ** Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. NOTE: the vendor disputes the significance of this report because the user must accept an interstitial warning before the HTML file content is rendered and because the HTML content's origin is a sandbox domain.


Cross-site scripting (XSS) vulnerability in IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002 8.6 before 8.6 IFix 004 8.7 before 8.7 IFix 004 8.8 before 8.8 iFix 003 9.0 before 9.0.0.1 iFix 003 and 9.0.1 before 9.0.1 iFix 001 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.


Multiple cross-site scripting (XSS) vulnerabilities in TorrentFlux 2.4 allow (1) remote attackers to inject arbitrary web script or HTML by leveraging failure to encode file contents when downloading a torrent file or (2) remote authenticated users to inject arbitrary web script or HTML via vectors involving a link to torrent details.


Cross-site scripting (XSS) vulnerability in the Admin UI in IBM Tivoli Directory Server 6.1 before 6.1.0.64-ISS-ITDS-IF0064 6.2 before 6.2.0.39-ISS-ITDS-FP0039 and 6.3 before 6.3.0.33-ISS-ITDS-IF0033 and IBM Security Directory Server 6.3.1 before 6.3.1.7-ISS-ISDS-IF0007 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) t parameter to iframe-googlefont-preview.php or the (2) text parameter to iframe-font-preview.php.


Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka \OWA XSS Vulnerability \ a different vulnerability than CVE-2014-6326.


Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold 2010 Update 1 and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka \XSS in Signurl.asp Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15 4.3.x before 4.3.7 and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the RemoveXSS function and allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (2) the backend.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

DiamondList

and

possibly

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

categorydescription

parameter

to

which

is

not

properly

handled

by

and

the

parameter

to

which

is

not

properly

handled

by


Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages (2) Add Global Content (3) Edit Global Content (4) Add Article (5) Add Category (6) Add Field Definition or (7) Add Shortcut module.


Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a (1) showList or (2) Search action.


Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang parameter.


Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3 when proxy mode is enabled allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Proxy Granting Ticket IOU (PGTiou) parameter to the callback function in client.php (2) vectors involving functions that make getCallbackURL calls or (3) vectors involving functions that make getURL calls.


Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) an action description (2) an action message (3) a node or (4) a taxonomy term related to the actions feature and the trigger module.


Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8 and Horde Groupware Webmail Edition before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action related to the Fetchmail configuration.


Multiple cross-site scripting (XSS) vulnerabilities in Open Classifieds 1.7.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) desc (2) price (3) title and (4) place parameters to index.php and the (5) subject parameter to contact.htm related to content/contact.php.


Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 and 4.0.2.x before 4.0.2.7-P8AE-FP007 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in ProfileView.aspx in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to inject arbitrary web script or HTML via the User ID parameter. NOTE: some of these details are obtained from third party information.


The toStaticHTML function in Microsoft Internet Explorer 8 and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 SharePoint Foundation 2010 Office SharePoint Server 2007 SP2 Groove Server 2010 and Office Web Apps allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule aka \HTML Sanitization Vulnerability \ a different vulnerability than CVE-2010-1257.


Multiple cross-site scripting (XSS) vulnerabilities in the Gopher parser in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11 and SeaMonkey before 2.0.9 allow remote attackers to inject arbitrary web script or HTML via a crafted name of a (1) file or (2) directory on a Gopher server.


Cross-site scripting (XSS) vulnerability in the Performance logging module in the Devel module 5.x before 5.x-1.3 and 6.x before 6.x-1.21 for Drupal allows remote authenticated users with add url aliases and report access permissions to inject arbitrary web script or HTML via crafted node paths in a URL.


Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14 4.2.x before 4.2.13 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager or unspecified parameters to unknown backend forms.


The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

phpMyAdmin

before

and

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

vectors

related

to

js/messages.php

libraries/common.lib.php

libraries/sanitizing.lib.php

libraries/sqlparser.lib.php

setup/config.php

sql.php

and


cms_write.php in Primitive CMS 1.0.9 does not properly restrict access which allows remote attackers to gain administrative privileges via a direct request. NOTE: this vulnerability can be leveraged to conduct cross-site scripting attacks as demonstrated using the (1) title (2) content and (3) menutitle parameters.


Cross-site scripting (XSS) vulnerability in AffiliateLogin.asp in ProductCart 3 4.1 SP1 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the redirectUrl parameter a different vector than CVE-2004-2174 and CVE-2005-0995. NOTE: some of these details are obtained from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Symphony

CMS

and

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

fieldswebsite

parameter

in

the

post

comments

feature

in

articles/a-primer-to-symphony-2s-default-theme/

or

send-emailrecipient

parameter

to

about/.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x before 1.5.21 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving \multiple encoded entities \ as demonstrated by the query string to index.php in the com_weblinks or com_content component.


Cross-site scripting (XSS) vulnerability in index.php in the hosted_signup module in NetArt Media iBoutique.MALL 1.2 allows remote attackers to inject arbitrary web script or HTML via the tmpl parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) a plugin name related to manage_plugin_uninstall.php; (2) an enumeration value or (3) a String value of a custom field related to core/cfdefs/cfdef_standard.php; or a (4) project or (5) category name to print_all_bug_page_word.php.


Multiple cross-site scripting (XSS) vulnerabilities in the rendering engine in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13 and SeaMonkey before 2.0.11 allow remote attackers to inject arbitrary web script or HTML via (1) x-mac-arabic (2) x-mac-farsi or (3) x-mac-hebrew characters that may be converted to angle brackets during rendering.


Cross-site scripting (XSS) vulnerability in multiple Rocomotion products including P board 1.18 and other versions P forum 1.30 and earlier P up board 1.38 and other versions P diary R 1.13 and earlier P link 1.11 and earlier P link compact 1.04 and earlier pplog 3.31 and earlier pplog2 3.37 and earlier PM bbs 1.07 and earlier PM up bbs 1.08 and earlier and PM forum 1.18 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors.


Cross-site scripting (XSS) vulnerability in backend/plugin/Registration/index.php in Mollify 1.6 1.6.5.5 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the confirm parameter. NOTE: some of these details are obtained from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Tomaz

Muraus

Open

Blog

and

possibly

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

excerpt

parameter

to

as

reachable

by

admin/posts/edit;

and

the

content

parameter

to

as

reachable

by

admin/posts/edit.


Cross-site scripting (XSS) vulnerability in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to inject arbitrary web script or HTML via the command parameter to the administration interface as demonstrated by the command parameter to ESAdmin/collection.do.


Multiple cross-site scripting (XSS) vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the pcd parameter to edit_bug.aspx (2) the bug_id parameter to edit_comment.aspx (3) the id parameter to edit_user_permissions2.aspx or (4) the default_name parameter to edit_customfield.aspx. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability on the HP 3Com OfficeConnect Gigabit VPN Firewall 3CREVF100-73 with firmware before 1.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: a separate XSS issue for HP System Management Homepage (SMH) was originally assigned CVE-2010-3010 due to a CNA error but CVE-2010-3012 is the appropriate identifier for the SMH issue.


Cross-site

scripting

(XSS)

vulnerability

in

in

Mahara

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the username (aka default_user_name) field or (2) the password field in a Users Login action to index.php or (3) the label parameter in a Settings GetFieldInfo action to index.php related to modules/Settings/GetFieldInfo.php.


Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8 and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka \HTML Sanitization Vulnerability.\


Cross-site scripting (XSS) vulnerability in ajax.php in Wiccle Web Builder (WWB) 1.00 and 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the post_text parameter in a site custom_search action to index.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related in part to \URL injection.\


Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.


Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages) a different vulnerability than CVE-2010-3056.


Microsoft Outlook Web Access (OWA) 8.2.254.0 when Internet Explorer 7 on Windows Server 2003 is used does not properly handle the id parameter in a Folder IPF.Note action to the default URI which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.


Cross-site scripting (XSS) vulnerability in the mobile portal in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold 2010 Update 1 and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka \XSS Issue on UAG Mobile Portal Website in Forefront Unified Access Gateway Vulnerability.\


Cross-site scripting (XSS) vulnerability in the Wordfilter module 5.x before 5.x-1.1 and 6.x before 6.x-1.1 for Drupal allows remote authenticated users with \administer words filtered\ privileges to inject arbitrary web script or HTML via the word list.


Cross-site scripting (XSS) vulnerability in jsp/audit/reports/ExportReport.jsp in ManageEngine ADAudit Plus 4.0.0 build 4043 allows remote attackers to inject arbitrary web script or HTML via the reportList parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) bannerid parameter in conjunction with a /admin/ad/banner/list PATH_INFO; and allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (3) title or (4) answers parameter in conjunction with a /admin/poll/add PATH_INFO or the (5) name parameter in conjunction with a /admin/category/add PATH_INFO.


Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content related to (1) action/LikePages.py (2) action/chart.py and (3) action/userprofile.py a similar issue to CVE-2010-2487.


The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3.5.12 Thunderbird before 3.0.7 and SeaMonkey before 2.0.7 does not properly restrict scripted functions which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted function.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

on

the

IBM

BladeCenter

with

Advanced

Management

Module

(AMM)

firmware

build

ID

and

possibly

other

versions

before

and

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

INDEX

or

IPADDR

parameter

to

private/cindefn.php

the

domain

parameter

to

private/power_management_policy_options.php

the

slot

parameter

to

or

the

WEBINDEX

parameter

to

or

the

SLOT

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in index.php in AJ Square AJ Article 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) emailid (2) fname (3) lname (4) company (5) address1 (6) address2 (7) city (8) state (9) zipcode (10) phone and (11) fax parameters in an update action. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X and before 10.11 on UNIX platforms allows remote attackers to inject arbitrary web script or HTML via a data: URI related to incorrect detection of the \opening site.\


Multiple cross-site scripting (XSS) vulnerabilities in Gambit Design Bandwidth Meter 0.72 and possibly 1.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) view_by_name.php or (2) view_by_ip.php in admin/. NOTE: some sources report that the affected product is ShaPlus Bandwidth Meter but this is incorrect.


Cross-site scripting (XSS) vulnerability in the JExtensions JE Awd Song (com_awd_song) component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the song review field which is not properly handled in a view action to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in the Rotor Banner module 5.x before 5.x-1.8 and 6.x before 6.x-2.5 for Drupal allow remote authenticated users with \create rotor item\ or \edit any rotor item\ privileges to inject arbitrary web script or HTML via the (1) srs (2) title or (3) alt image attribute.


Multiple cross-site scripting (XSS) vulnerabilities in Sijio Community Software allow remote authenticated users to inject arbitrary web script or HTML via the title parameter when (1) editing a new blog (2) adding an album or (3) editing an album. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the Hierarchical Select module 5.x before 5.x-3.2 and 6.x before 6.x-3.2 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors in the hierarchical_select form.


Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack.


Multiple cross-site scripting (XSS) vulnerabilities in content/internalError.jsp in IBM WebSphere ILOG JRules 6.7 allow remote attackers to inject arbitrary web script or HTML via an RTS URL to (1) explore/explore.jsp (2) compose/compose.jsp or (3) home.jsp in faces/.


Cross-site scripting (XSS) vulnerability in editing/markup.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 allows remote attackers to inject arbitrary web script or HTML via vectors related to the node.innerHTML property of a TEXTAREA element. NOTE: this might overlap CVE-2010-1762.


Microsoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to an attribute.


ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form control via the __VIEWSTATE parameter.


Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content related to (1) action/SlideShow.py (2) action/anywikidraw.py and (3) action/language_setup.py a similar issue to CVE-2010-2487.


Multiple cross-site scripting (XSS) vulnerabilities in resin-admin/digest.php in Caucho Technology Resin Professional 3.1.5 3.1.10 4.0.6 and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) digest_realm or (2) digest_username parameters. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.


Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter as demonstrated by an attack against dijit/tests/form/test_Button.html.


Multiple cross-site scripting (XSS) vulnerabilities in CruxSoftware CruxPA 2.00 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the (1) txtusername parameter to login.php (2) todo parameter to newtodo.php and unspecified vectors to (3) newtelephone.php and (4) newappointment.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

IBM

WebSphere

Service

Registry

and

Repository

(WSRR)

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

searchTerm

parameter

to

ServiceRegistry/HelpSearch.do

or

the

parameter

to


Cross-site scripting (XSS) vulnerability in include/tool/editing_files.php in gpEasy CMS 1.6.2 allows remote authenticated users with Edit privileges to inject arbitrary web script or HTML via the gpcontent parameter to index.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Synology Disk Station 2.x before DSM3.0-1337 allow remote attackers to inject arbitrary web script or HTML by connecting to the FTP server and providing a crafted (1) USER or (2) PASS command which is written by the FTP logging module to a web-interface log window related to a \web commands injection\ issue.


The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.


Multiple cross-site scripting (XSS) vulnerabilities in the ActiveHelper LiveHelp (com_activehelper_livehelp) component 2.0.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via (1) the DOMAINID parameter to server/cookies.php or (2) the SERVER parameter to server/index.php.


Multiple cross-site scripting (XSS) vulnerabilities in Accoria Web Server (aka Rock Web Server) 1.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the getenv sample program (2) the desc parameter to loadstatic.cgi (3) the name parameter to httpdcfg.cgi or (4) the dns parameter to servercfg.cgi.


Multiple cross-site scripting (XSS) vulnerabilities in Pay Per Minute Video Chat Script 2.0 and 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/memberviewdetails.php and the (2) model parameter to videos.php.


Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users with certain module privileges to inject arbitrary web script or HTML via the (1) fullname (2) phone or (3) im parameter in a stormperson action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in LISTSERV 15 and 16 allows remote attackers to inject arbitrary web script or HTML via the T parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9 Thunderbird before 3.0.7 and 3.1.x before 3.1.3 and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset which allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms via UTF-7 encoding.


Multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter to testsdic and the (2) helpstring parameter to paramhelp.jsp.


Apache MyFaces 1.1.7 and 1.2.8 as used in IBM WebSphere Application Server and other applications does not properly handle an unencrypted view state which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Dojo

before

before

before

before

and

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors

possibly

related

to

and

as

demonstrated

by

the

dojoUrl

and

testUrl

parameters

to


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Cacti

before

as

used

in

Red

Hat

High

Performance

Computing

(HPC)

Solution

and

other

products

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

name

element

in

an

XML

template

to

and

allow

remote

authenticated

administrators

to

inject

arbitrary

web

script

or

HTML

via

vectors

related

to

cdef.php

graph.php

graphs.php

host.php

lib/functions.php

lib/html.php

lib/rrd.php

rra.php

tree.php

and


Cross-site scripting (XSS) vulnerability in the Search Site in CMScout 2.09 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: some of these details are obtained from third party information.


Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.


Multiple cross-site scripting (XSS) vulnerabilities in odCMS 1.06 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the Page parameter to (1) _main/index.php (2) _members/index.php (3) _forum/index.php (4) _docs/index.php and (5) _announcements/index.php.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Connections 2.5.x before 2.5.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) create or (2) edit form in the Communities component the (3) verbiage field in the Bookmarks component or (4) unspecified vectors related to the Mobile Blogs component.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

MoinMoin

and

earlier

before

and

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

crafted

content

related

to

Page.py

PageEditor.py

PageGraphicalEditor.py

action/CopyPage.py

action/Load.py

action/RenamePage.py

action/backup.py

action/login.py

action/newaccount.py

and

action/recoverpass.py.


Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 when Firefox or Chrome is used allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to URL parsing.


Cross-site scripting (XSS) vulnerability in Sijio Community Software allows remote authenticated users to inject arbitrary web script or HTML via the title parameter when adding a new blog related to edit_blog/index.php. NOTE: some of these details are obtained from third party information.


Cross-site

scripting

(XSS)

vulnerability

in

axis2-admin/axis2-admin/engagingglobally

in

the

administration

console

in

Apache

and

possibly

other

versions

as

used

in

SAP

Business

Objects

IMC

and

possibly

other

products

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

modules

parameter.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Cross-site scripting (XSS) vulnerability in the Web Monitor in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold 2010 Update 1 and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka \UAG XSS Allows EOP Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in Cisco Wireless Control System (WCS) 7.x before 7.0.164 as used in Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors aka Bug ID CSCtg33854.


Multiple cross-site scripting (XSS) vulnerabilities in zc/publisher/html.rb in ZoneCheck 2.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) xmlnode.value (2) zc-error text (3) $zc_version (4) domainname in a zc-title row different vulnerabilities than CVE-2009-4882.


Cross-site scripting (XSS) vulnerability in the Bibliography (Biblio) module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users with \administer biblio\ privileges to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2010-1358.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

formatQuery

function

in

in

Zabbix

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

parameters

to

the

triggers

page

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404 status code related to (1) paste.urlparser.StaticURLParser (2) paste.urlparser.PkgResourcesParser (3) paste.urlmap.URLMap and (4) HTTPNotFound.


Cross-site scripting (XSS) vulnerability in webacs/QuickSearchAction.do in the search feature in the web interface in Cisco Wireless Control System (WCS) before 6.0(194.0) and 7.x before 7.0.164 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter aka Bug ID CSCtf14288.


Cross-site scripting (XSS) vulnerability in Home.aspx in DataTrack System 3.5 and 3.5.8019.4 allows remote attackers to inject arbitrary web script or HTML via the Work_Order_Summary parameter (aka the request summary). NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in rekonq 0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) a URL associated with a nonexistent domain name related to webpage.cpp aka a \universal XSS\ issue; (2) unspecified vectors related to webview.cpp; and the about: views for (3) favorites (4) bookmarks (5) closed tabs and (6) history.


Cross-site scripting (XSS) vulnerability in error.php in Pilot Group (PG) eLMS Pro allows remote attackers to inject arbitrary web script or HTML via the message parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in modfile.php in Event Horizon (EVH) 1.1.10 when magic_quotes_gpc is disabled allow remote attackers to inject arbitrary web script or HTML via the (1) YourEmail and (2) VerificationNumber parameters which are not properly handled in a forced SQL error message. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users with certain module privileges to inject arbitrary web script or HTML via the (1) fullname (2) address (3) city (4) provstate (aka state) (5) phone or (6) taxid parameter in a stormorganization action to index.php; the (7) name parameter in a stormperson action to index.php; the (8) stepno (aka Step no.) or (9) title parameter in a stormtask action to index.php; the (10) title (aka Project) parameter in a stormticket action to index.php; or (11) unspecified parameters in a stormproject action to index.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9 Thunderbird before 3.0.7 and 3.1.x before 3.1.3 and SeaMonkey before 2.0.7 allows user-assisted remote attackers to inject arbitrary web script or HTML via a selection that is added to a document in which the designMode property is enabled.


Cross-site scripting (XSS) vulnerability in index.php in RightInPoint Lyrics Script 3.0 allows remote attackers to inject arbitrary web script or HTML via the artist_id parameter which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) redirects aka SPL-31067; (2) unspecified \user->user or user->admin\ vectors aka SPL-31084; or (3) unspecified \user input \ aka SPL-31085.


Oracle Mojarra 1.2_14 and 2.0.2 as used in IBM WebSphere Application Server Caucho Resin and other applications does not properly handle an unencrypted view state which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.


Multiple cross-site scripting (XSS) vulnerabilities in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5.0.2 allow remote attackers to inject arbitrary web script or HTML via (1) the date1 parameter to pvm_messagestore.php (2) the userfilter parameter to pvm_user_management.php (3) the ping parameter to sys_tools.php in a sys_ping.php action (4) the action parameter to pvm_cert_commaction.php (5) the action parameter to pvm_cert_serveraction.php (6) the action parameter to pvm_smtpstore.php (7) the l parameter to sla/index.php or (8) unspecified stored data; and allow remote authenticated users to inject arbitrary web script or HTML via (9) saved search filters.


Cross-site scripting (XSS) vulnerability in help/readme.nsf/Header in the Help component in IBM Lotus Domino 7.x before 7.0.4 and 8.x before 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the BaseTarget parameter in an OpenPage action. NOTE: this may overlap CVE-2010-0920.


Multiple cross-site scripting (XSS) vulnerabilities in staff/index.php in Kayako SupportSuite 3.60.04 and earlier allow remote authenticated users to inject arbitrary web script or HTML via the (1) subject parameter and (2) contents parameter (aka body) in an insertquestion action. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in login.jsp in IBM WebSphere Portal IBM Lotus Web Content Management (WCM) and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5 6.0.0.0 through 6.0.0.4 6.0.1.0 through 6.0.1.7 6.1.0.0 through 6.1.0.3 and 6.1.5.0; and IBM Lotus Quickr services 8.0 8.0.0.2 8.1 8.1.1 and 8.1.1.1 for WebSphere Portal; allows remote attackers to inject arbitrary web script or HTML via the query string.


Cross-site scripting (XSS) vulnerability in index.php in BGSvetionik BGS CMS 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the return parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-domain vulnerability in Microsoft Internet Explorer 6 6 SP1 7 and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the client user drags one browser window across another browser window aka \HTML Element Cross-Domain Vulnerability.\


Cross-site scripting (XSS) vulnerability in the Login page in IBM Lotus Web Content Management (WCM) 6.0.1.4 6.0.1.5 and 6.0.1.6 before iFix 32; and 6.1.0.1 and 6.1.0.2 before iFix 24; for WebSphere Portal allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.


Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier as used in Opentaps Neogia and Entente Oya allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login) (3) the start parameter to myportal/control/showPortalPage (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn) (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle (6) the entityName parameter to webtools/control/FindGeneric or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.


Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8 and SeaMonkey before 2.0.3 does not properly support the application/octet-stream content type as a protection mechanism against execution of web script in certain circumstances involving SVG and the EMBED element which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via an embedded SVG document.


Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.2.0 and other versions before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) tab parameter to users.php and the PATH_INFO to (2) day.php (3) month.php and (4) week.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048 and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1) 8.1(2.7) and 8.0(5); allows remote attackers to inject arbitrary web script or HTML via a crafted POST parameter which is not properly handled by an eval statement in binary/mainv.js that writes to start.html.


Cross-site scripting (XSS) vulnerability in product_list.php in JCE-Tech PHP Calendars downloaded 2010-01-11 allows remote attackers to inject arbitrary web script or HTML via the cat parameter. NOTE: this issue is reportedly resultant from a forced SQL error message that occurs from exploitation of CVE-2010-0375.


Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users with Instructor privileges to inject arbitrary web script or HTML via the (1) Question and (2) Choice fields in tools/polls/add.php the (3) Type and (4) Title fields in tools/groups/create_manual.php and the (5) Title field in assignments/add_assignment.php. NOTE: some of these details are obtained from third party information.


Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.


Cross-site scripting (XSS) vulnerability in C3 Corp. WebCalenderC3 0.32 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: this issue could not be reproduced by the vendor but a patch was provided anyway. The original researcher is reliable.


Cross-site scripting (XSS) vulnerability in assess.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the reports comment box in a continue_assess action. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the tb-send.rb (TrackBack transmission) plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors possibly related to the (1) plugin_tb_url and (2) plugin_tb_excerpt parameters.


Multiple cross-site scripting (XSS) vulnerabilities in HP Project and Portfolio Management Center (PPMC formerly Mercury IT Governance) 7.1 through SP10 and 7.5 through SP3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in index.php in dl Download Ticket Service before 0.7 allows remote attackers to inject arbitrary web script or HTML via the t parameter related to an invalid ticket ID. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the Node Blocks module 5.x-1.1 and earlier and 6.x-1.3 and earlier a module for Drupal allows remote authenticated users with permissions to create or edit content and administer blocks to inject arbitrary web script or HTML via the edit-title parameter (aka block title).


Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43 6.1 before 6.1.0.33 and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of \XSS/CSRF Get Filter and Referer Check fixes.\


Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier and SharePoint Services 3.0 SP1 and SP2 versions allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter.


Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to a malformed URL.


Cross-site scripting (XSS) vulnerability in the KJ: Imagelightbox (kj_imagelightbox2) extension 2.0.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2008-2490.


Cross-site scripting (XSS) vulnerability in the iTweak Upload module 6.x-1.x before 6.x-1.2 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users with create content and upload file permissions to inject arbitrary web script or HTML via the file name of an uploaded file.


Cross-site scripting (XSS) vulnerability in ViewVC 1.1 before 1.1.5 and 1.0 before 1.0.11 when the regular expression search functionality is enabled allows remote attackers to inject arbitrary web script or HTML via vectors related to \search_re input \ a different vulnerability than CVE-2010-0736.


Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20 when the personal content manager is enabled allows user-assisted remote authenticated users to inject arbitrary web script or HTML via the content_heading parameter.


Mozilla Firefox 3.0.x before 3.0.18 3.5.x before 3.5.8 and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture and possibly conduct cross-site scripting (XSS) attacks by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.


_layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments) which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading TXT files a related issue to CVE-2008-5026. NOTE: the vendor disputes the significance of this issue because cross-domain isolation can be implemented when needed.


Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f as used in Red Hat High Performance Computing (HPC) Solution and other products allow remote attackers to inject arbitrary web script or HTML via the (1) hostname or (2) description parameter to host.php or (3) the host_id parameter to data_sources.php.


Multiple cross-site scripting (XSS) vulnerabilities in the Internationalization module 6.x before 6.x-1.4 for Drupal allow remote authenticated users with translate interface or administer blocks privileges to inject arbitrary web script or HTML via (1) strings used in block translation or (2) the untranslated input.


Cross-site scripting (XSS) vulnerability in the Control Panel module 5.x through 5.x-1.5 and 6.x through 6.x-1.2 for Drupal allows remote authenticated users with \administer blocks\ privileges to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in lib/LXR/Common.pm in LXR Cross Referencer before 0.9.8 allows remote attackers to inject arbitrary web script or HTML via vectors related to a string in the search page's TITLE element a different vulnerability than CVE-2009-4497 and CVE-2010-1625.


Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the (1) func parameter to index.php or the (2) lang parameter to index.php which is not properly handled by ZLanguage.php.


Cross-site scripting (XSS) vulnerability in the Taxonomy Breadcrumb module 5.x before 5.x-1.5 and 6.x before 6.x-1.1 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via the taxonomy term name in a Breadcrumb display.


Cross-site scripting (XSS) vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to inject arbitrary web script or HTML via the userid parameter in a modboard action which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in login_reset_password_page.php in Tracking Requirements & Use Cases (TRUC) 0.11.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12 2.9.x before 2.9.12 2.10.x before 2.10.11 2.11.x before 2.11.6 and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.


Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4 and SeaMonkey before 2.0.5 does not properly handle situations in which both \Content-Disposition: attachment\ and \Content-Type: multipart\ are present in HTTP headers which allows remote attackers to conduct cross-site scripting (XSS) attacks via an uploaded HTML document.


Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users with create or edit permissions and 'Path to File' or 'URL to File' display enabled to inject arbitrary web script or HTML via the file name (filepath parameter).


Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) article-id parameter in conjunction with a /admin/news/article/list PATH_INFO; the (3) keyword parameter in conjunction with a /admin/multimedia/set/list PATH_INFO; the (4) keyword or (5) fileId parameter in conjunction with a /admin/multimedia/file/list PATH_INFO; or the (6) name (7) email or (8) address parameter in conjunction with a /admin/ad/client/list PATH_INFO.


Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML in a TEXTAREA element.


Cross-site scripting (XSS) vulnerability in the Workflow module 5.x-2.x before 5.x-2.6 and 6.x-1.x before 6.x-1.4 for Drupal when used with the Token module might allow remote authenticated users to inject arbitrary web script or HTML via a certain Comment field.


The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property which allows remote attackers to conduct cross-site scripting (XSS) attacks as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.


Multiple cross-site scripting (XSS) vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to \various administrator screens \ possibly the search parameter in administrator/index.php.


Cross-site scripting (XSS) vulnerability in blog/index.php in Uiga Business Portal allows remote attackers to inject arbitrary web script or HTML via the textcomment parameter (aka the Comment Box) in a noentryid action. NOTE: some of these details are obtained from third party information.


The regular expression engine in JRuby before 1.4.1 when $KCODE is set to 'u' does not properly handle characters immediately after a UTF-8 character which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.


Multiple cross-site scripting (XSS) vulnerabilities in WebAsyst Shop-Script FREE allow remote attackers to inject arbitrary web script or HTML via the (1) currency_id_left (2) currency_id_right (3) darkcolor (4) lightcolor (5) middlecolor and (6) w parameters.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users with \Add new article\ privileges to inject arbitrary web script or HTML via the (1) title (2) subTitle and (3) author parameters in conjunction with a /admin/news/article/add PATH_INFO.


The protocolIs function in platform/KURLGoogle.cpp in WebCore in WebKit before r55822 as used in Google Chrome before 4.1.249.1036 and Flock Browser 3.x before 3.0.0.4112 does not properly handle whitespace at the beginning of a URL which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted javascript: URL as demonstrated by a \\x00javascript:alert sequence.


Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).


Multiple cross-site scripting (XSS) vulnerabilities in admin/admin_login.php in Uiga Fan Club as downloaded on 20100310 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_name and (2) admin_password parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The XSS Filter in Microsoft Internet Explorer 8 does not properly perform neutering for the SCRIPT tag which allows remote attackers to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities a different issue than CVE-2009-4074.


Cross-site scripting (XSS) vulnerability in the Bibliography (Biblio) module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users with \administer biblio\ privileges to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in DFD Cart 1.198 1.197 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) category and (2) list_quantity parameters to index.php and the (3) category parameter to your.order.php.