Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) StrMsg or (2) Topic_ID parameter to (a) vf_info.asp (b) vf_newtopic.asp (c) vf_settings.asp and (d) vf_replytopic.asp different vectors than CVE-2006-6447. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via the (1) Taaa parameter to (a) up.php or the (2) pollhtml and (3) Bloks parameters to (b) polls.php different vectors than CVE-2006-5770.


Multiple cross-site scripting (XSS) vulnerabilities in PHP Live! 3.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search_string parameter in (a) setup/transcripts.php the (2) l parameter in (b) index.php the (3) login field in (c) phplive/index.php and the (4) deptid and (5) x parameters in (d) phplive/message_box.php.


Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary HTML and web script via the (1) title and (2) newspost parameters to (a) newsadd.php and the (3) name title and (4) comment parameters to (b) news.php a different set of vectors than CVE-2006-1818. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Drupal (1) Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0 and (2) Project 4.6.x-1.0 4.7.x-1.0 and 4.7.x-2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters which do not use the check_plain function.


Mozilla Firefox 2.x before 2.0.0.1 1.5.x before 1.5.0.9 Thunderbird before 1.5.0.9 and SeaMonkey before 1.0.7 allows remote attackers to bypass cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI.


Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the domain parameter to (1) scripts2/changeemail (2) scripts2/limitbw or (3) scripts/rearrangeacct. NOTE: the feature parameter to scripts2/dofeaturemanager is already covered by CVE-2006-6198.


Multiple cross-site scripting (XSS) vulnerabilities in Rialto 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) listmain.asp or (b) searchmain.asp the (2) the Keyword parameter to (c) searchkey.asp or the (3) refno parameter to (d) forminfo.asp.


Mozilla Firefox 2.0 before 2.0.0.1 allows remote attackers to bypass Cross-Site Scripting (XSS) protection via vectors related to a Function.prototype regression error.


Multiple cross-site scripting (XSS) vulnerabilities in the MyArticles module before 0.6 beta 1 for RunCMS allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) topics.php (2) submit.php and (3) class/calendar.class.php.


Cross-site scripting (XSS) vulnerability in hata.asp in Cilem Haber Free Edition allows remote attackers to inject arbitrary web script or HTML via the hata parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Messageriescripthp 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo parameter to (a) existepseudo.php the (2) email parameter to (b) existeemail.php or the (3) pageName or (4) cssform parameter to (c) Contact/contact.php.


Multiple cross-site scripting (XSS) vulnerabilities in ScriptMate User Manager 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) members_username (user) and (2) members_password (password) fields in a login action in members/default.asp and (3) the Search box. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in pbguestbook.php in JAB Guest Book 20061205 allow remote attackers to inject arbitrary web script or HTML via the (1) topic or (2) message parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in tiki-edit_structures.php in TikiWiki 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the pageAlias parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in DMXReady Secure Login Manager 1.0 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified parameters to (1) set_preferences.asp (2) send_password_preferences.asp and (3) SecureLoginManager/list.asp in the Local-Admin Panel.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

through

beta

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

in

(a)

(b)

and

(c)

in

inc/VIEW/errors/;

the

baseurl

parameter

in

(d)

and

the

ReqURI

parameter

in

(e)


Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php (b) month.php (c) year.php (d) week.php (e) search.php (f) rss/index.php (g) print.php and (h) preferences.php; the (2) cpath parameter in (i) day.php (j) month.php (k) year.php (l) week.php and (m) search.php; the (3) query parameter in search.php; and possibly the cpath (4) unset and (5) set parameters in a setcookie action in preferences.php; different vectors than CVE-2006-3319. NOTE: it was later reported that vectors b c and d also affect 2.24.


Cross-site scripting (XSS) vulnerability in jce.php in the JCE Admin Component in Ryan Demmer Joomla Content Editor (JCE) 1.0.4 for Joomla! (com_jce) without the 20060821 jce_patch allows remote attackers to inject arbitrary web script or HTML via the mosConfig_live_site parameter.


Cross-site scripting (XSS) vulnerability in an unspecified component of Moodle 1.5 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. NOTE: It is unclear whether this candidate overlaps CVE-2006-4784 or CVE-2006-4941.


Cross-site scripting (XSS) vulnerability in the Network controller in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000 13.x before 13.050.03.000 and 14.x before 14.050.03.000 allows remote attackers to inject arbitrary web script or HTML via HTTP TRACE messages.


Multiple cross-site scripting (XSS) vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the email parameter in (1) erreurinscription.php (2) Templates/admin.dwt.php (3) Templates/commun.dwt.php (4) membre.dwt.php and (5) admin/admin_config/Aide.php.


Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Omniture SiteCatalyst allow remote attackers to inject arbitrary web script or HTML via the (1) ss parameter in (a) search.asp and the (2) company and (3) username fields on (b) the web login page. NOTE: some details were obtained from third party information.


Cross-site scripting (XSS) vulnerability in templates/cat_temp.php in PHPNews 1.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site

scripting

(XSS)

vulnerability

in

in

Cerberus

Helpdesk

through

and

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

js

parameter.

NOTE:

The

provenance

of

this

information

is

unknown;

the

details

are

obtained

solely

from

third

party

information.


Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the (1) set parameter to admin/modules.php the (2) selected_box parameter to definitiva/admin/customers.php the (3) lID parameter to admin/languages_definitions.php or the (4) pID parameter to admin/products.php.


Cross-site scripting (XSS) vulnerability in addpost1.asp in BaalAsp forum allows remote attackers to inject arbitrary web script or HTML via the name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo (2) email (3) date (4) sujet (5) message (6) site and (7) lien parameters to (a) admin/change.php and the (8) aa parameter to (b) lire-avis.php.


Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php the (2) session and (3) delete_draft parameters in (b) compose.php and (4) unspecified vectors involving \a shortcoming in the magicHTML filter.\


Multiple cross-site scripting (XSS) vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the prefs parameter in a buildnavprefs action or (2) the navprefs parameter in a savenavprefs action.


Cross-site scripting (XSS) vulnerability in SeleniumServer Web Server 1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in VerliAdmin 0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in Carsen Klock TextSend 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) error or (2) success parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.


Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php.


Cross-site scripting (XSS) vulnerability in display.php in HyperVM 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an encoded frm_action parameter. NOTE: the vendor disputes this issue but it is not certain whether the dispute is about the severity of the issue or its existence.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

PHPOLL

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

language

parameter

to

index.php

info.php;

and

index.php

votanti.php

and

in

admin/.


Multiple cross-site scripting (XSS) vulnerabilities in BlueCollar i-Gallery 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) n or (2) d parameter in igallery.asp or (3) an unspecified parameter related to search possibly the Search Gallery field or the myquery parameter in search.asp. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the CVS management/tracker 4.7.x-1.0 4.7.x-2.0 and 4.7.0 (before the 20060807 contribution release system) for Drupal allows remote attackers to inject arbitrary web script or HTML via the motivation field in the CVS application page which is not passed through check_markup on display.


Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog (SPHPBlog) probably 0.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) the action parameter in add_block.php or (2) the entry parameter in index.php different vectors than CVE-2005-1135. NOTE: this has been reported to affect 0.8 but as of 20061121 the most recent version is only 0.4.9.


Cross-site scripting (XSS) vulnerability in auth/message.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF). NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


The phpmyadmin subsystem in AlternC 0.9.5 and earlier transmits the SQL password in cleartext in a cookie which might allow remote attackers to obtain the password by sniffing or by conducting a cross-site scripting (XSS) attack.


Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6 4.1.0 through 4.1.31 5.0.0 through 5.0.30 and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.


Cross-site scripting (XSS) vulnerability in WikkaWiki (Wikka Wiki) before 1.1.6.2 allows remote attackers to inject arbitrary javascript via (1) events in forced links (url parameter) that are not properly handled in formatters/wakka.php and possibly (2) other vectors in wikka.php.


Scriptsez.net E-Dating System stores data files with predictable names under the web document root with insufficient access control which allows remote attackers to read private messages and leverage them for cross-site scripting (XSS) attacks.


Multiple cross-site scripting (XSS) vulnerabilities in Sphider before 1.3.1c allow remote attackers to inject arbitrary web script or HTML via the catid parameter to (1) templates/standard/search_form.html and (2) templates/dark/search_form.html. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0 and possibly other versions before 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the url parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net E-Dating System allow remote attackers to inject arbitrary web script or HTML via encoded entities (&#0000039) in IMG tags to (1) messages (2) profile fields or (3) the id parameter in a dologin operation to cindex.php.


Multiple cross-site scripting (XSS) vulnerabilities in fx-APP 0.0.8.1 allow remote attackers to inject arbitrary HTML or web script via (1) the search box and the (2) url (3) website (4) comment and (5) signature fields in the profile and possibly (6) a menu item.


Cross-site scripting (XSS) vulnerability in add_comment.php in Wheatblog (wB) 1.1 allows remote attackers to inject arbitrary web script or HTML via the Email field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue may overlap CVE-2006-5195.


Multiple cross-site scripting (XSS) vulnerabilities in Professional Home Page Tools Login Script as of July 2006 allow remote attackers to inject arbitrary web script or HTML via the (1) name (2) vorname and (3) nachname parameters in the register script. NOTE: some details have been obtained from third party sources.


Multiple cross-site scripting (XSS) vulnerabilities in Chipmunk Blogger allow remote authenticated users to inject arbitrary web script or HTML via script tags in (1) posts and (2) profile names; and (3) a javascript URI in a URL argument in the photo gallery.


Cross-site scripting (XSS) vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier allows remote attackers to inject arbitrary web script and HTML via the (1) busername and (2) c parameters to (a) index.php the busername parameter to (b) admin/index.php and (3) cphone parameter to register.php.


Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the query string to (a) index.php which reflects the string in an error message from mod_login.php; and the (2) mcname parameter to (b) moscomment.php and (c) com_comment.php.


Cross-site scripting (XSS) vulnerability in email_request.php in PSY Auction allows remote attackers to inject arbitrary web script or HTML via the user_id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in phpTrafficA before 1.2beta2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to keywords results in the (1) main (2) daily (3) weekly (4) monthly (5) new trends (6) individual page and (7) search engine statistics.


Cross-site scripting (XSS) vulnerability in cgi-bin/user-lib/topics.pl in web-app.net WebAPP before 20060515 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the viewnews function related to use of doubbctopic instead of doubbc.


Cross-site scripting (XSS) vulnerability in Opentools Attachment Mod before 2.4.5 allows remote attackers to inject arbitrary web script or HTML in Internet Explorer via unknown vectors related to the uploaded attachments form. NOTE: some details were obtained from third party information.


Cross-site scripting (XSS) vulnerability in Oracle Application Express (APEX) before 2.2.1 aka Oracle HTML DB allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATION_MSG parameter. NOTE: it is likely that this issue overlaps one of the identifiers in CVE-2006-5351.


Cross-site scripting (CSS) vulnerability in Lotus Domino 5.0.6 allows remote attackers to execute script on other web clients via a URL that ends in Javascript which generates an error message that does not quote the resulting script.


Cross-site scripting (CSS) vulnerability in gnut Gnutella client before 0.4.27 allows remote attackers to execute arbitrary script on other clients by sharing a file whose name contains the script tags.


Autogalaxy stores usernames and passwords in cleartext in cookies which makes it easier for remote attackers to obtain authentication information and gain unauthorized access via sniffing or a cross-site scripting attack.


Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php (2) ttitle letter and file parameters in modules.php (3) subject story and storyext parameters in submit.php (4) upload parameter in admin.php and (5) fname parameter in friend.php.


Cross-site scripting vulnerability in Allaire JRun 3.0 and 2.3.3 allows a malicious webmaster to embed Javascript in a request for a .JSP .shtml .jsp10 .jrun or .thtml file that does not exist which causes the Javascript to be inserted into an error message.


Bugzilla before 2.14 does not properly escape untrusted parameters which could allow remote attackers to conduct unauthorized activities via cross-site scripting (CSS) and possibly SQL injection attacks on (1) the product or output form variables for reports.cgi (2) the voteon bug_id and user variables for showvotes.cgi (3) an invalid email address in createaccount.cgi (4) an invalid ID in showdependencytree.cgi (5) invalid usernames and other fields in process_bug.cgi and (6) error messages in buglist.cgi.


Multiple cross-site scripting (XSS) vulnerabilities in the log messages in certain Alpha versions of AOL Instant Messenger (AIM) 4.4 allow remote attackers to execute arbitrary web script or HTML via an image in the (1) DATA (2) STYLE or (3) BINARY tags.


Cross-site scripting vulnerability in Webalizer 2.01-06 and possibly other versions allows remote attackers to inject arbitrary HTML tags by specifying them in (1) search keywords embedded in HTTP referrer information or (2) host names that are retrieved via a reverse DNS lookup.


Cross-site scripting vulnerability in IBM WebSphere 3.02 and 3.5 FP2 allows remote attackers to execute Javascript by inserting the Javascript into (1) a request for a .JSP file or (2) a request to the webapp/examples/ directory which inserts the Javascript into an error page.


Cross-site scripting (CSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause other clients to execute certain script or read cookies via malicious script in an invalid URL that is not properly quoted in an error message.


Cross-site

scripting

(XSS)

vulnerability

in

the

smwfOnSfSetTargetName

function

in

in

Semantic

Enterprise

Wiki

(SMW+)

and

earlier

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

target

parameter

to

index.php/Special:FormEdit.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers to inject arbitrary web script or HTML via the (1) domainName parameter to jsp/AddDC.jsp or (2) operation parameter to DomainConfig.do.


Multiple cross-site scripting (XSS) vulnerabilities in revisioning_theme.inc in the Taxonomy module in the Revisioning module 6.x-3.13 and other versions before 6.x-3.14 for Drupal allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) tags or (2) term parameters.


Cross-site

scripting

(XSS)

vulnerability

in

in

Zen

Cart

and

earlier

when

the

software

is

being

installed

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to


Cross-site scripting (XSS) vulnerability in password_policy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote authenticated users with administer policies permissions to inject arbitrary web script or HTML via the name parameter.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Open

Journal

Systems

before

allow

remote

attackers

and

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

editor

or

callback

parameters

to

in

the

iBrowser

plugin

authorsurl

parameter

to

index.php

or

Bio

Statement

or

Abstract

of

Submission

fields

to

the

stripUnsafeHtml

function

in


Cross-site

scripting

(XSS)

vulnerability

in

in

OSCommerce

Online

Merchant

when

the

software

is

being

installed

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

name

parameter

to

oscommerce/index.php

which

is

not

properly

handled

in

an

error

message.

NOTE:

this

might

not

be

a

vulnerability

since

the

ability

to

access

oscommerce/index.php

during

installation

may

already

imply

administrator

privileges.


Cross-site scripting (XSS) vulnerability in checkQKMProg.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100) also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Apache

Struts

and

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

name

or

lastName

parameter

to

or

the

clientName

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in the Data module 6.x-1.x before 6.x-1.0 and 7.x-1.x before 7.x-1.0-alpha3 for Drupal allow remote authenticated users with the administer data tables permission to inject arbitrary web script or HTML via the title parameter in (1) data.views.inc and (2) data_ui/data_ui.admin.inc.


Cross-site scripting (XSS) vulnerability in the wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to inject arbitrary web script or HTML via a crafted page with \forged strip item markers \ as demonstrated using the CharInsert extension.


The Content Security Policy (CSP) implementation in Mozilla Firefox 4.x through 12.0 Firefox ESR 10.x before 10.0.5 Thunderbird 5.0 through 12.0 Thunderbird ESR 10.x before 10.0.5 and SeaMonkey before 2.10 does not block inline event handlers which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document.


Multiple cross-site scripting (XSS) vulnerabilities in the Managesite module 6.x-1.x before 6.1-1.1 for Drupal allow remote authenticated users with \administer managesite\ permissions to inject arbitrary web script or HTML via the title parameter when (1) adding or (2) updating a category.


Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric Kerweb before 3.0.1 and Kerwin before 6.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the evtvariablename parameter in an evts.xml action to kw.dll (2) unspecified search fields or (3) unspecified content-display fields.


Cross-site

scripting

(XSS)

vulnerability

in

in

OSCommerce

Online

Merchant

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

as

demonstrated

using

the

\Front\

field

in

the

shirt

module.


Cross-site

scripting

(XSS)

vulnerability

in

in

the

select

helper

in

Ruby

on

Rails

before

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

vectors

involving

certain

generation

of

OPTION

elements

within

SELECT

elements.


Cross-site scripting (XSS) vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors possibly related to the \return url parameter.\


Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cms_tpv_view parameter to wp-admin/options-general.php.


Cross-site scripting (XSS) vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204 and possibly other versions before 9.0.1.19899 allows remote attackers to inject arbitrary web script or HTML via the newUser parameter. NOTE: this might not be a vulnerability since an administrator might already have the privileges to create arbitrary script.


Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL aka \SharePoint Reflected List Parameter Vulnerability.\


Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL which allows remote attackers to bypass unspecified cross-site scripting (XSS) protection mechanisms via a feed:javascript: URL.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Etano

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

user

email

or

agree

parameter

to

join.php;

st

wphoto

search

or

v

parameter

to

search.php;

or

st

parameter

to

or

return

parameter

to


Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12 3.1.x before 3.1.4 and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.


Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args (3) title (4) before_title or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php.


Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow and sFlow Analyzer 8.6.2.16204 and other versions before 9.0.1.19899 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter.


Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal when the \Select (or other)\ module is enabled allow remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to (1) checkboxes or (2) radios.


Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the status program on the ForeScout CounterACT appliance with software 6.3.3.2 through 6.3.4.10 allow remote attackers to inject arbitrary web script or HTML via (1) the loginname parameter in a forgotpass action or (2) the username parameter.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Apache

Struts

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

name

parameter

to

or

the

message

parameter

to

struts-cookbook/processSimple.do

or

struts-cookbook/processDyna.do.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

admin

panel

in

osCMax

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

username

parameter

in

a

process

action

to

admin/login.php;

pageTitle

or

cPath

parameter

to

or

path

parameter

to

admin/htaccess.php;

title

parameter

to

search

parameter

to

admin/xsell.php;

gross

or

max

parameter

to

status

parameter

to

sorted

parameter

to

parameter

to

or

zID

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13 4.5.0 through 4.5.13 4.6.0 through 4.6.6 4.7 and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.


The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13 4.5.0 through 4.5.13 4.6.0 through 4.6.6 4.7 and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.


Cross-site scripting (XSS) vulnerability in the WebAAA login functionality (wba_login.html) in Juniper Networks Mobility System Software (MSS) 7.6.x before 7.6.3 7.7.x before 7.7.1 7.5.x before 7.5.3 and other unspecified versions before 7.4 and 7.3 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter name.


Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via (1) a parameter array in freemarker templates the (2) contentId or (3) mapKey parameter in a cms event request which are not properly handled in an error message or unspecified input in (4) an ajax request to the getServerError function in checkoutProcess.js or (5) a Webslinger component request. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in freelancerKit 2.35 allow remote attackers to inject arbitrary web script or HTML via the (1) ticket parameter to tickets.php (2) title parameter to notes.php or (3) task parameter to todo.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4.x before 4 RC4 allow remote attackers to inject arbitrary web script or HTML via the (1) Back parameter to admin/ad.php or the (2) token or (3) f_email parameter to admin/password_check_token.php.


Multiple cross-site scripting (XSS) vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body parameter to admin/preview.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

\stand

alone

PHP

application

for

the

OSM

Player

as

used

in

the

MediaFront

module

before

and

before

for

Drupal

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

or

to

playlist

parameter

to

and

possibly

other

vectors

related

to


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

amCharts

Flash

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

parameter

to

ampie.swf;

the

message

element

in

the

parameter

to

amcolumn.swf

amline.swf

amradar.swf

or

amxy.sw;

or

the

parameter

to

amstock.swf.


Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context-menu restrictions for data: URLs as for javascript: URLs which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.


An unspecified parser-utility class in Mozilla Firefox 4.x through 13.0 Firefox ESR 10.x before 10.0.6 Thunderbird 5.0 through 13.0 Thunderbird ESR 10.x before 10.0.6 and SeaMonkey before 2.11 does not properly handle EMBED elements within description elements in RSS feeds which allows remote attackers to conduct cross-site scripting (XSS) attacks via a feed.


Multiple cross-site scripting (XSS) vulnerabilities in the History Window implementation in Kadu 0.9.0 through 0.11.0 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) SMS message (2) presence message or (3) status description.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

XWiki

Enterprise

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

xwiki/bin/commentadd/Main/WebHome

parameter

when

editing

a

user

profile

or

projectVersion

parameter

to

xwiki/bin/view/DownloadCode/DownloadFeedback.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Multiple cross-site scripting (XSS) vulnerabilities in Sphinx Software Mobile Web Server 3.1.2.47 allow remote attackers to inject arbitrary web script or HTML via the comment parameter to a blog as demonstrated using (1) Blog/MyFirstBlog.txt or (2) Blog/AboutSomething.txt.


Cross-site scripting (XSS) vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1 SharePoint Foundation 2010 Gold and SP1 and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL aka \XSS scriptresx.ashx Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in Kongreg8 1.7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) surname or (2) firstname parameters to modules/members/addmember.php; or (3) groupdescription or (4) groupname parameters to modules/groups/addgroupform.php.


Cross-site scripting (XSS) vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to \the vocabulary's help text.\


Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admins/login/forgot/index.php or the (2) display_name or (3) email parameter to account/preferences.php.


Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to users/index.


Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork (3) network or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566 and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.


Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text (2) FirstName (3) LastName (4) OrganisationName (5) OrganisationUrl (6) Profession (7) Country (8) State (9) Address (10) Location (11) Telephone (12) VoIP (13) InstantMessagingIM (14) Email (15) HomePage or (16) Comment parameter. NOTE: some of these details are obtained from third party information.


The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9 Communicator 2007 R2 and Lync 2010 and 2010 Attendee does not properly handle event attributes and script which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document aka \HTML Sanitization Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in wonderdesk.cgi in WonderDesk SQL 4.14 allow remote attackers to inject arbitrary web script or HTML via the (1) cus_email parameter in a cust_lostpw action; or (2) help_name (3) help_email (4) help_website or (5) help_example_url parameters in an hd_modify_record action.


Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php (2) sortOrder1 parameter to templates/hrfunct/emppop.php or (3) uri parameter to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type (4) sortby (5) order or (6) status parameters to admin/comments.php; or (7) page parameter to admin/plugin.php.


Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38 5.0x before 5.07 and 5.1x before 5.13 when the product is incompletely installed allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter a different vulnerability than CVE-2012-0318.


Cross-site scripting (XSS) vulnerability in the web server in the ECOM Ethernet module in Koyo H0-ECOM H0-ECOM100 H2-ECOM H2-ECOM-F H2-ECOM100 H4-ECOM H4-ECOM-F and H4-ECOM100 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and 7.x-1.x-rc1 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via the (1) title parameter in faq.admin.inc or (2) detailed_question parameter in faq.module.


Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 Gold and SP1 SharePoint Foundation 2010 Gold and SP1 and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL aka \SharePoint Script in Username Vulnerability.\


Cross-site scripting (XSS) vulnerability in the Finder module 6.x-1.x before 6.x-1.26 7.x-1.x and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the \checkbox and radio button functionalities.\


Mozilla Firefox before 15.0 Thunderbird before 15.0 and SeaMonkey before 2.12 do not prevent use of the Object.defineProperty method to shadow the location object (aka window.location) which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.


template/en/default/list/list.js.tmpl in Bugzilla 2.x and 3.x before 3.6.9 3.7.x and 4.0.x before 4.0.6 and 4.1.x and 4.2.x before 4.2.1 does not properly handle multiple logins which allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive bug information via a crafted web page.


Cross-site scripting (XSS) vulnerability in themeweb.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL aka \XSS in themeweb.aspx Vulnerability.\


Cross-site scripting (XSS) vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party information.


Cross-site

scripting

(XSS)

vulnerability

in

display_renderers/panels_renderer_editor.class.php

in

the

admin

view

in

the

Panels

module

before

and

before

for

Drupal

allows

remote

authenticated

users

with

certain

privileges

to

inject

arbitrary

web

script

or

HTML

via

the

Region

title.


Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache (2) rtemode or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the management interface on the Cisco IronPort Encryption Appliance with software before 6.5.3 allows remote attackers to inject arbitrary web script or HTML via the header parameter to the default URI under admin/ aka bug ID 72410.


Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 9.0 Thunderbird 5.0 through 9.0 and SeaMonkey before 2.7 allow remote attackers to inject arbitrary web script or HTML via a (1) web page or (2) Firefox extension related to improper enforcement of XPConnect security restrictions for frame scripts that call untrusted objects.


Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 11.0 Firefox ESR 10.x before 10.0.4 Thunderbird 5.0 through 11.0 Thunderbird ESR 10.x before 10.0.4 and SeaMonkey before 2.9 allow remote attackers to inject arbitrary web script or HTML via the (1) ISO-2022-KR or (2) ISO-2022-CN character set.


Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1 when Internet Explorer is used allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the \Duplicate comment detected\ feature.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ImpressCMS

before

Final

and

before

Final

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

to

notifications.php

and


Cross-site scripting (XSS) vulnerability in the Start Center Layout and Configuration component in IBM Maximo Asset Management and Asset Management Essentials 6.2 7.1 and 7.5; IBM Tivoli Asset Management for IT 6.2 7.1 and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2 7.1 and 7.2 allows remote attackers to inject arbitrary web script or HTML via the display name.


Cross-site scripting (XSS) vulnerability in Horde_Form in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to email verification. NOTE: Some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional Enterprise and Premium 4.26 and earlier 5.x before 5.53 and 6.x before 6.03 allows remote attackers to inject arbitrary web script or HTML via the Username parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Demand Media Pluck SiteLife before 5.0.13 allow remote attackers to inject arbitrary web script or HTML via (1) the jsonRequest parameter to Direct/Process the (2) r or (3) cb parameter to Direct/jsonp.htm or (4) the cb parameter to sys/jsonp.app/.htm.


Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07 03-00 through 03-00-04 and possibly other versions before 03-00-06 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in wizardlist.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL aka \XSS in wizardlist.aspx Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only (3) online_only or (4) mode parameters to viewFriends.php.


The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7 wheezy before 2.2.22-4 and sid before 2.2.22-4 when mod_php or mod_rivet is used provides example scripts under the doc/ URI which might allow local users to conduct cross-site scripting (XSS) attacks gain privileges or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

XOOPS

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

or

the

or

target

parameter

to


Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows Mac OS X Linux and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka \Universal XSS (UXSS) \ as exploited in the wild in February 2012.


Cross-site scripting (XSS) vulnerability in Jenkins before 1.454 Jenkins LTS before 1.424.5 and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2012-0324.


Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0 Firefox ESR 10.x before 10.0.4 Thunderbird 5.0 through 11.0 Thunderbird ESR 10.x before 10.0.4 and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set.


Cross-site scripting (XSS) vulnerability in TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3 Service Grid and Service Bus 3.x before 3.1.5 BusinessWorks Service Engine 5.9.x before 5.9.3 and BPM before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost (2) dbname or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also it is unclear whether this specific XSS scenario has security relevance.


Cross-site

scripting

(XSS)

vulnerability

in

in

OpenNMS

before

and

earlier

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

Username

field

related

to

login.


Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) login.php (2) admin.php or (3) preferences.php.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 as used in SmartCloud Control Desk Tivoli Asset Management for IT Tivoli Service Request Manager Maximo Service Desk and Change and Configuration Management Database (CCMDB) allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Mozilla Firefox before 3.6.28 and 4.x through 10.0 Firefox ESR 10.x before 10.0.3 Thunderbird before 3.1.20 and 5.0 through 10.0 Thunderbird ESR 10.x before 10.0.3 and SeaMonkey before 2.8 do not properly restrict drag-and-drop operations on javascript: URLs which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web page related to a \DragAndDropJacking\ issue.


Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in an external action to zp-core/admin.php (2) PATH_INTO to an unspecified URL as demonstrated using /1/ (3) PATH_INFO to zp-core/admin.php or (4) album parameter to zp-core/admin-edit.php.


Multiple cross-site scripting (XSS) vulnerabilities in Acidcat CMS 3.5.1 3.5.2 3.5.6 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin_colors.asp (2) admin_config.asp and (3) admin_cat_add.asp in admin/.


CRLF injection vulnerability in Mozilla Firefox 4.x through 10.0 Firefox ESR 10.x before 10.0.3 Thunderbird 5.0 through 10.0 Thunderbird ESR 10.x before 10.0.3 and SeaMonkey before 2.8 allows remote web servers to bypass intended Content Security Policy (CSP) restrictions and possibly conduct cross-site scripting (XSS) attacks via crafted HTTP headers.


Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity (2) sPattern (3) sPriceMax and (4) sPriceMin parameters in a search action to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in OxWall 1.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) captchaField (2) email (3) form_name (4) password (5) realname (6) repeatPassword or (7) username parameters to Oxwall/join; (8) captcha (9) email (10) form_name (11) from or (12) subject parameters to Oxwall/contact; (13) tag parameter to Oxwall/blogs/browse-by-tag; or (14) PATH_INFO to Oxwall/photo/viewlist/tagged (15) Oxwall/photo/viewlist or (16) Oxwall/video/viewlist.


Cross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0 Firefox ESR 10.x before 10.0.4 Thunderbird 5.0 through 11.0 Thunderbird ESR 10.x before 10.0.4 and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via vectors related to short-circuited page loads aka \Universal XSS (UXSS).\


The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style Sheets (CSS) escaped character which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML input aka \AntiXSS Library Bypass Vulnerability.\


Cross-site scripting (XSS) vulnerability in Jenkins before 1.454 Jenkins LTS before 1.424.5 and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2012-0325.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Fortinet

FortiGate

UTM

WAF

appliances

with

FortiOS

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

vectors

involving

the

Endpoint

Monitor

Dialup

List

or

Log&Report

Display

modules

or

the

parameter

to

user/auth/list

or

endpointcompliance/app_detect/predefined_sig_list.


Multiple cross-site scripting (XSS) vulnerabilities in GuestAccess.jsp in the Guest/Contractor access component in the administrative interface in Bradford Network Sentry before 5.3.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified fields.


ModSecurity before 2.6.6 when used with PHP does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.


Cross-site scripting (XSS) vulnerability in deferredView.jsp in IBM Eclipse Help System (IEHS) as used in IBM Security AppScan Source 7.x and 8.x before 8.6 and IBM SPSS Data Collection Developer Library 6.0 and 6.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter in the configuration module (2) installstatus parameter in the languages_new module or (3) theme parameter in the theme module.


Cross-site scripting (XSS) vulnerability in phpgwapi/inc/common_functions_inc.php in eGroupware before 1.8.004.20120405 allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to etemplate/process_exec.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element (2) a crafted Cascading Style Sheets (CSS) expression property (3) a CSS expression property in the STYLE attribute of an arbitrary element or (4) a crafted SRC attribute of an IFRAME element or an e-mail message subject with (5) a SCRIPT element (6) a CSS expression property in the STYLE attribute of an arbitrary element (7) a crafted SRC attribute of an IFRAME element (8) a crafted CONTENT attribute of an HTTP-EQUIV=\refresh\ META element or (9) a data: URL in the CONTENT attribute of an HTTP-EQUIV=\refresh\ META element.


Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to the (1) System Agent or (2) End Entity pages.


Multiple cross-site scripting (XSS) vulnerabilities in SiliSoftware phpThumb() 1.7.11 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter to demo/phpThumb.demo.random.php or (2) title parameter to demo/phpThumb.demo.showpic.php.


Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3 when the MultiViews option is enabled allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.


wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.


Cross-site

scripting

(XSS)

vulnerability

in

in

OSCommerce

Online

Merchant

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

a

different

vulnerability

than


player.swf in LongTail JW Player 5.9 allows remote attackers to conduct cross-site scripting (XSS) attacks to inject arbitrary web script or HTML via multiple \javascript:\ sequences in the debug parameter.


Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a JavaScript alert function used in conjunction with the fromCharCode method (2) a SCRIPT element (3) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (4) an innerHTML attribute within an XML document.


Cross-site scripting (XSS) vulnerability in admin/webservice/forms.php in the web services implementation in Moodle 2.0.x before 2.0.9 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the name field (aka the service name) to admin/webservice/service.php.


Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter in a lostpassword action to wp-login.php.


Multiple cross-site scripting (XSS) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.1 for Drupal when supporting manual entry of field identifiers allow remote attackers to inject arbitrary web script or HTML via vectors related to thrown exceptions and logging errors.


Multiple cross-site scripting (XSS) vulnerabilities in Cumin before 0.1.5444 as used in Red Hat Enterprise Messaging Realtime and Grid (MRG) 2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) \error message displays\ or (2) \in source HTML on certain pages.\


Cross-site scripting (XSS) vulnerability in the administration forms in the ShareThis module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with administer sharethis permissions to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the Extension::MobileUI extension before 1.02 for Best Practical Solutions RT 3.8.x and in Best Practical Solutions RT before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

Creative

Commons

module

before

for

Drupal

allow

remote

authenticated

users

with

the

administer

creative

commons

permission

to

inject

arbitrary

web

script

or

HTML

via

the

or

creativecommons_site_license_additional_text

parameter.


Multiple cross-site scripting (XSS) vulnerabilities in ESCON SupportPortal Professional Edition 3.0 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element (2) a crafted SRC attribute of an IFRAME element (3) a crafted CONTENT attribute of an HTTP-EQUIV=\Set-Cookie\ META element or (4) an innerHTML attribute within an XML document.


Cross-site scripting (XSS) vulnerability in the Wiki subsystem in Moodle 2.0.x before 2.0.9 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is inserted into a page title.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

pragmaMx

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

name

parameter

to

modules.php

or

to


Cross-site scripting (XSS) vulnerability in Microsoft Systems Management Server 2003 SP3 and System Center Configuration Manager 2007 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka \Reflected XSS Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) Mobile URL field or (2) Desktop URL field to the General configuration page or the (3) message to the Mobile Tools block message options.


Cross-site scripting (XSS) vulnerability in lib/filelib.php in Moodle 2.0.x before 2.0.9 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via an assignment submission with zip compression leading to text/html rendering during a \download all\ action.


Cross-site scripting (XSS) vulnerability in the Protest module 6.x-1.x before 6.x-1.2 or 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the \administer protest\ permission to inject arbitrary web script or HTML via the protest_body parameter.


Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element (2) a crafted Cascading Style Sheets (CSS) expression property (3) a CSS expression property in the STYLE attribute of an arbitrary element (4) a crafted SRC attribute of an IFRAME element or (5) UTF-7 text in an HTTP-EQUIV=\CONTENT-TYPE\ META element.


Cross-site scripting (XSS) vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier as used in WordPress before 3.5.2 TinyMCE Image Manager 1.1 and earlier and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter a different vulnerability than CVE-2012-3414.


Multiple cross-site scripting (XSS) vulnerabilities in Viscacha 0.8.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) text field in the Private Messages System (2) Bad Word field in Zensur or (3) Portal or (4) Topic field in Kommentar.


Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) the Cascading Style Sheets (CSS) expression property in conjunction with a CSS comment within the STYLE attribute of an IMG element (2) the CSS expression property in conjunction with multiple CSS comments within the STYLE attribute of an arbitrary element or (3) an innerHTML attribute within an XML document.


Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal allow remote authenticated users with the administer product classes permission to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter in a move or (2) minimize action to admin/admin_index.php; (3) the karma_username parameter to module.php in the karma module; (4) q_1_low (5) q_1_high (6) q_2_low or (7) q_2_high parameter in a configure action to module.php in the captcha module; or (8) the edit parameter to module.php in the admin_language module.


Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server 2005 SP4 2008 SP2 and SP3 2008 R2 SP1 and 2012 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter aka \Reflected XSS Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in Bloxx Web Filtering before 5.0.14 allow (1) remote attackers to inject arbitrary web script or HTML via web traffic that is examined within the Bloxx Reports component and allow (2) remote authenticated administrators to inject arbitrary web script or HTML via vectors involving administrative menu functions.


Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) page parameter to (a) admin/admin_comments.php or (b) admin/admin_links.php; or list parameter in a (3) move or (4) minimize action to (c) admin/admin_index.php.


Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms (2) links or (3) resources URLs and (4) the Display name in a user profile.


Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow remote authenticated users with create or edit taxonomy terms permissions to inject arbitrary web script or HTML via vectors related to taxonomy information.


Cross-site scripting (XSS) vulnerability in the aberdeen_breadcrumb function in template.php in the Aberdeen theme 6.x-1.x before 6.x-1.11 for Drupal when set to append the content title to the breadcrumb allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb.


Cross-site scripting (XSS) vulnerability in the MultiBlock module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer blocks permission to inject arbitrary web script or HTML via the block title.


wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the themes_links function in template.php in the Amadou theme module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to class attributes in a list of links.


Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5 1.18.x before 1.18.4 and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page.


Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 7.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to group.php or the (2) target_language or (3) target_flag parameter to translate.php.


Multiple cross-site scripting (XSS) vulnerabilities in fancy_slide.module in the Fancy Slide module before 6.x-2.7 for Drupal allow remote authenticated users with the administer fancy_slide permission to inject arbitrary web script or HTML via the (1) node_title or (2) nodequeue_title parameter.


Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the selitems parameter in a (1) copy (2) chmod or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/index.php.


Multiple cross-site scripting (XSS) vulnerabilities in the (1) Self-Service Console and (2) Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Query Studio in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1 10.1 before IF2 10.1.1 before IF2 and 10.2 before IF1 allows user-assisted remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element (2) a crafted Cascading Style Sheets (CSS) expression property (3) a CSS expression property in the STYLE attribute of an arbitrary element (4) an ONLOAD attribute of a BODY element (5) a crafted SRC attribute of an IFRAME element (6) a crafted CONTENT attribute of an HTTP-EQUIV=\refresh\ META element or (7) a data: URL in the CONTENT attribute of an HTTP-EQUIV=\refresh\ META element.


Cross-site

scripting

(XSS)

vulnerability

in

Microsoft

InfoPath

and

and

Communicator

Lync

and

Attendee

SharePoint

Server

and

and

Groove

Server

Windows

SharePoint

Services

SharePoint

Foundation

and

Office

Web

Apps

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

string

aka

\HTML

Sanitization

Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13 3.0.x before 3.0.15 and 3.1.x before 3.1.9 and OTRS ITSM 2.1.x before 2.1.5 3.0.x before 3.0.6 and 3.1.x before 3.1.6 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV=\CONTENT-TYPE\ META element.


Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation (2) syscontact or (3) sysName field of an snmpd.conf file.


Cross-site scripting (XSS) vulnerability in the GoodReader app 3.16 and earlier for iOS on the iPad and 3.15.1 and earlier for iOS on the iPhone and iPod touch allows remote attackers to inject arbitrary web script or HTML via vectors involving use of this app in conjunction with a web browser.


Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) leaflet_layer.php or (2) leaflet_marker.php as reachable through wp-admin/admin.php.


The filter_titles function in the Smart Breadcrumb module 6.x-1.x before 6.x-1.3 for Drupal does not properly convert a title to plain-text which allows remote authenticated users with create or edit node permissions to conduct cross-site scripting (XSS) attacks via the title parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary web script or HTML via an e-mail message subject with (1) a JavaScript alert function used in conjunction with the fromCharCode method or (2) a SCRIPT element; an e-mail message body with (3) a crafted SRC attribute of an IFRAME element (4) a data: URL in the CONTENT attribute of an HTTP-EQUIV=\refresh\ META element or (5) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an IMG element; or an e-mail message Date header with (6) a JavaScript alert function used in conjunction with the fromCharCode method (7) a SCRIPT element (8) a CSS expression property in the STYLE attribute of an arbitrary element (9) a crafted SRC attribute of an IFRAME element or (10) a data: URL in the CONTENT attribute of an HTTP-EQUIV=\refresh\ META element.


Cross-site scripting (XSS) vulnerability in the Language Icons module 6.x-2.x before 6.x-2.1 and 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with administer languages permissions to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.


Multiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) \user names in page titles\ and (2) \autocomplete callbacks.\


Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the u_email parameter (aka Authors Email field) to manager/users.php (2) the u_realname parameter (aka Authors Name field) to manager/users.php or (3) the c_author parameter (aka Author field) in an ADD A COMMENT section.


Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter in the show-league page or (2) season parameter in the team page to wp-admin/admin.php.


Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary field to apps/contacts/ajax/addcard.php (2) the parameter parameter to apps/contacts/ajax/addproperty.php (3) the name parameter to apps/contacts/ajax/createaddressbook (4) the file parameter to files/download.php or the (5) name (6) user or (7) redirect_url parameter to files/index.php.


Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in IBM Lotus Protector for Mail Security 2.1 2.5 2.5.1 and 2.8 and IBM ISS Proventia Network Mail Security System allow remote attackers to inject arbitrary web script or HTML via the query string.


Cross-site

scripting

(XSS)

vulnerability

in

the

function

in

in

the

Hostmaster

(Aegir)

module

before

for

Drupal

allows

remote

authenticated

users

with

certain

permissions

to

inject

arbitrary

web

script

or

HTML

via

a

Drush

log

message

in

a

provision

task

log.


Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394 allow remote attackers to inject arbitrary web script or HTML via (1) the wrsApprovedURL parameter to addRuleAttrWrsApproveUrl.imss or (2) the src parameter to initUpdSchPage.imss.


Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal when \Append the content title to the end of the breadcrumb\ is enabled allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb.


Cross-site scripting (XSS) vulnerability in the Printer email and PDF versions module 6.x-1.x before 6.x-1.15 and 7.x-1.x before 7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors probably the PATH_INFO.


Multiple cross-site scripting (XSS) vulnerabilities in artpublic/recommandation/index.php in Artiphp CMS 5.5.0 Neo (r422) allow remote attackers to inject arbitrary web script or HTML via the (1) add_img_name_post (2) asciiart_post (3) expediteur (4) titre_sav or (5) z39d27af885b32758ac0e7d4014a61561 parameter.


Cross-site scripting (XSS) vulnerability in the Contact Forms module 6.x-1.x before 6.x-1.13 for Drupal when the core contact form is enabled allows remote authenticated users with the administer site-wide contact form permission to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1 10.1 before IF2 10.1.1 before IF2 and 10.2 before IF1 allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors related to the search feature.


in

the

Authoring

HTML

module

before

for

Drupal

does

not

properly

validate

sources

with

the

host

white

list

which

allows

remote

authenticated

users

to

bypass

intended

access

restrictions

and

conduct

cross-site

scripting

(XSS)

attacks.


Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to data/file/edit.php (2) the q parameter to confirm.php or (3) the keyword parameter to users/users.php.


Mozilla Firefox before 16.0 Thunderbird before 16.0 and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy which allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging initial-origin access after document.domain has been set.


Cross-site

scripting

(XSS)

vulnerability

in

the

ProcessRequest

function

in

in

Mono

and

earlier

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

file

with

a

crafted

name

and

a

forbidden

extension

which

is

not

properly

handled

in

an

error

message.


Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap (2) mod_info (3) mod_ldap (4) mod_proxy_ftp and (5) mod_status modules.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 Maximo Asset Management Essentials 7.1 Tivoli Asset Management for IT 7.1 and 7.2 Tivoli Service Request Manager 7.1 and 7.2 and Change and Configuration Management Database (CCMDB) 7.1 and 7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to a hidden frame footer.


Cross-site

scripting

(XSS)

vulnerability

in

in

Ruby

on

Rails

before

before

and

before

might

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

vectors

involving

a

(quote)

character.


Cross-site scripting (XSS) vulnerability in og.js in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal when used with the Vertical Tabs module allows remote authenticated users to inject arbitrary web script or HTML via vectors related the group title.


Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php or (2) time00 parameter to forensics/base_qry_main.php which is not properly handled in an error page.


Cross-site scripting (XSS) vulnerability in cohort/edit_form.php in Moodle 2.0.x before 2.0.10 2.1.x before 2.1.7 2.2.x before 2.2.4 and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2365.


Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.


Cross-site

scripting

(XSS)

vulnerability

in

in

the

helper

in

Ruby

on

Rails

before

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

malformed

HTML

markup.


Mozilla Firefox before 16.0 Firefox ESR 10.x before 10.0.8 Thunderbird before 16.0 Thunderbird ESR 10.x before 10.0.8 and SeaMonkey before 2.13 allow remote attackers to conduct cross-site scripting (XSS) attacks via a binary plugin that uses Object.defineProperty to shadow the top object and leverages the relationship between top.location and the location property.


Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) absender_name (2) absender_email or (3) absender_nachricht parameter to the content page; (4) comment_name (5) comment_subject or (6) comment_message parameter to the postacomment module; (7) module parameter to index.php; (8) action parameter to the admin login page; (9) pv or (10) pe parameter in a list action to the user module; (11) user_username (12) user_email (13) user_forename (14) user_name (15) user_street (16) user_postal (17) user_city (18) user_tel or (19) user_mobil parameter in a newUser action to the user module; (20) group_name or (21) group_desc parameter in a groupNew action to the user module; (22) name (23) browsername (24) seostring (25) keywords or (26) folder_id parameter in a newPage action to the pages module; (27) element_name or (28) element_cachetime parameter in a newElement action in the pages module; (29) aspect_name parameter in a newAspect action in the system module; (30) filemanager_name (31) filemanager_path (32) filemanager_upload_filter or (33) filemanager_view_filter parameter in a NewRepo action to the filemanager module; or (34) archive_title or (35) archive_path parameter in a newArchive action to the downloads module. NOTE: some of these details are obtained from third party information.


The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2 when the multisite feature is enabled does not properly assign the unfiltered_html capability which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.


Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers to inject arbitrary web script or HTML via the (1) link (2) logo.link or (3) aboutlink parameter or a nested URI scheme name for (4) javascript (5) asfunction or (6) vbscript.


Cross-site scripting (XSS) vulnerability in the embedded HTTP server in the Service Console in IBM Tivoli Monitoring 6.2.2 before 6.2.2-TIV-ITM-FP0009 and 6.3.2 before 6.2.3-TIV-ITM-FP0001 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.


Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php (2) the HTTP Referer header to d4d/exporters.php or (3) unspecified input to d4d/contextMenu.php.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Domino 7.x and 8.x before 8.5.4 allow remote attackers to inject arbitrary web script or HTML via (1) a URL accessed during use of the Mail template in the WebMail UI or (2) a URL accessed during use of Domino Help through the Domino HTTP server.


Mozilla Firefox before 16.0 Firefox ESR 10.x before 10.0.8 Thunderbird before 16.0 Thunderbird ESR 10.x before 10.0.8 and SeaMonkey before 2.13 do not properly manage history data which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive POST content via vectors involving a location.hash write operation and history navigation that triggers the loading of a URL into the history object.


Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45 7.0.x before 7.0.0.25 8.0.x before 8.0.0.4 and 8.5.x before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements related to a cross-frame scripting (XFS) issue.


Cross-site

scripting

(XSS)

vulnerability

in

in

Ruby

on

Rails

before

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

prompt

field

to

the

helper.


Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) groupname parameter in a savecategory in the users module; (2) virtual_filename (3) branch (4) contact_person (5) street (6) city (7) province (8) postal (9) country (10) tollfree (11) phone (12) fax or (13) mobile parameter in a saveitem action in the contacts module; (14) title parameter in a savecategory action in the menus module; (15) firstname or (16) lastname in a saveitem action in the users module; (17) meta_key or (18) meta_description in a saveitem action in the blog module; or (19) the PATH_INFO to admin/index.php.


Multiple cross-site scripting (XSS) vulnerabilities in WebNavigator in Siemens WinCC 7.0 SP3 and earlier as used in SIMATIC PCS7 and other products allow remote attackers to inject arbitrary web script or HTML via a (1) GET parameter (2) POST parameter or (3) Referer HTTP header.


The

django.http.HttpResponseRedirect

and

django.http.HttpResponsePermanentRedirect

classes

in

Django

before

and

before

do

not

validate

the

scheme

of

a

redirect

target

which

might

allow

remote

attackers

to

conduct

cross-site

scripting

(XSS)

attacks

via

a

data:

URL.


Cross-site scripting (XSS) vulnerability on the HP Color LaserJet CM3530 with firmware before 53.190.9 Color LaserJet CM60xx with firmware before 52.210.9 Color LaserJet CP3525 with firmware before 06.140.3 18 Color LaserJet CP4xxx with firmware before 07.120.6 Color LaserJet CP6015 with firmware before 04.160.3 LaserJet P3015 with firmware before 07.140.3 and LaserJet P4xxx with firmware before 04.170.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Tivoli Process Automation Engine (TPAE) in IBM Maximo Asset Management 6.2 through 7.5 Maximo Asset Management Essentials 6.2 through 7.5 Tivoli Asset Management for IT 6.2 through 7.2 Tivoli Service Request Manager 7.1 and 7.2 Maximo Service Desk 6.2 Change and Configuration Management Database (CCMDB) 7.1 and 7.2 and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 7.5 Maximo Asset Management Essentials 6.2 through 7.5 Tivoli Asset Management for IT 6.2 through 7.2 Tivoli Service Request Manager 7.1 and 7.2 Maximo Service Desk 6.2 Change and Configuration Management Database (CCMDB) 7.1 and 7.2 and SmartCloud Control Desk 7.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to a login action.


Cross-site scripting (XSS) vulnerability in the SEOgento plugin for Magento allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to a site name.


Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier as used in WordPress before 3.3.2 TinyMCE Image Manager 1.1 and other products allows remote attackers to inject arbitrary web script or HTML via the movieName parameter related to the \ExternalInterface.call\ function.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 7.5 Maximo Asset Management Essentials 6.2 through 7.5 Tivoli Asset Management for IT 6.2 through 7.2 Tivoli Service Request Manager 7.1 and 7.2 Maximo Service Desk 6.2 Change and Configuration Management Database (CCMDB) 7.1 and 7.2 and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to a display name.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 7.5 as used in SmartCloud Control Desk Tivoli Asset Management for IT Tivoli Service Request Manager Maximo Service Desk and Change and Configuration Management Database (CCMDB) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 as used in SmartCloud Control Desk Tivoli Asset Management for IT Tivoli Service Request Manager Maximo Service Desk and Change and Configuration Management Database (CCMDB) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Help link in the login panel in IBM Power Hardware Management Console (HMC) 7R7.1.0 before SP4 7R7.2.0 before SP2 and 7R7.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username (2) email_address (3) password (4) password_verify (5) firstname (6) lastname or (7) verification_code parameter to users/action/register. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) delete_id parameter or (2) extension parameter in an \Update Setting\ action to wp-admin/admin.php.


Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cerberus FTP Server before 5.0.6.0 allow (1) remote attackers to inject arbitrary web script or HTML via a log entry that is not properly handled within the Log Manager component and might allow (2) remote authenticated administrators to inject arbitrary web script or HTML via a Messages field to the servermanager program.


Cross-site scripting (XSS) vulnerability in the Spambot module 6.x-3.x before 6.x-3.2 and 7.x-1.x before 7.x-1.1 for Drupal allows certain remote attackers to inject arbitrary web script or HTML via a stopforumspam.com API response which is logged by the watchdog.


Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 and other versions including 1.2 allow remote attackers to inject arbitrary web script or HTML via a CSV header with \unknown fields \ which are not properly handled in error messages in the (1) bulk user (2) group and (3) group member upload capabilities. NOTE: this issue was originally part of CVE-2012-2243 but that ID was SPLIT due to different issues by different researchers.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Java

number

format

exception

handling

in

FortiGate

FortiDB

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

conversationContext

parameter

to

admin/auditTrail.jsf

mapolicymgmt/targetsMonitorView.jsf

vascan/globalsummary.jsf

vaerrorlog/vaErrorLog.jsf

database/listTargetGroups.jsf

sysconfig/listSystemInfo.jsf

vascan/list.jsf

network/router.jsf

mapolicymgmt/editPolicyProfile.jsf

or

mapolicymgmt/maPolicyMasterList.jsf.


Multiple cross-site scripting (XSS) vulnerabilities in the SilverStripe e-commerce module 3.0 for SilverStripe CMS allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName (2) Surname or (3) Email parameter to code/forms/OrderFormAddress.php; or the (4) FirstName or (5) Surname parameter to code/forms/ShopAccountForm.php.


Multiple cross-site scripting (XSS) vulnerabilities in Vessio NetBill 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) file title to accounts/admin/index.php or (3) comment parameter in the support page to accounts/index2.php.


Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to channels.php (2) collections.php (3) groups.php or (4) videos.php; (5) query parameter to search_result.php; or (6) type parameter to view_collection.php or (7) view_item.php.


Multiple cross-site scripting (XSS) vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to music/create (2) location parameter to events/create or (3) search parameter to widget/index/content_id/*.


Cross-site scripting (XSS) vulnerability in Jenkins before 1.491 Jenkins LTS before 1.480.1 and Jenkins Enterprise 1.424.x before 1.424.6.13 1.447.x before 1.447.4.1 and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ATutor

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

to

login.php

search.php

login.php/jscripts/infusion

browse.php/jscripts/infusion/framework/fss

about.php

or


Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21 4.6.x before 4.6.14 and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for vBulletin when creating a new monster allow remote attackers to inject arbitrary web script or HTML via the (1) monstertitle or (2) monsterdescription parameters.


Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22 as used in Horde Groupware Webmail Edition before 4.0.9 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment a different vulnerability than CVE-2012-5565.


Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action.


Multiple cross-site scripting (XSS) vulnerabilities in the FirstLastNames plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script or HTML via the (1) User/FirstName or (2) User/LastName parameter to the edit user page. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation (2) syscontact or (3) sysName configuration in snmpd.conf. NOTE: this entry was SPLIT from CVE-2012-2956 per ADT2 due to different vulnerability types.


Cross-site scripting (XSS) vulnerability in the autocomplete functionality in the Finder module 6.x-1.x before 6.x-1.26 7.x-1.x and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via the title of a node a different vulnerability than CVE-2012-1561.


jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions jQuery only deems the input to be HTML if it explicitly starts with the '<' character limiting exploitability only to attackers who can control the beginning of a string which is far less common.


Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the reason parameter in (1) actions/nominatemedal.php or (2) actions/requestmedal.php.


Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the (1) reportreason parameter in actions/doreport.php or (2) modnotes parameter in actions/updatereport.php.


Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php.


Multiple cross-site scripting (XSS) vulnerabilities in the AboutMe plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script or HTML via the (1) AboutMe/RealName (2) AboutMe/Name (3) AboutMe/Quote (4) AboutMe/Loc (5) AboutMe/Emp (6) AboutMe/JobTit (7) AboutMe/HS (8) AboutMe/Col (9) AboutMe/Bio (10) AboutMe/Inter (11) AboutMe/Mus (12) AboutMe/Gam (13) AboutMe/Mov (14) AboutMe/FTV or (15) AboutMe/Bks parameter to the Edit My Details page. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to inject arbitrary web script or HTML via the headline parameter aka Bug ID CSCud65187 a different vulnerability than CVE-2012-5992.


Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) PWRS or (2) Description field when posting a new vehicle; (3) news title when creating news; (4) Name when creating a sub user; (5) group name when creating a group; or (6) dealer name (7) first name or (8) last name when changing a profile.