Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39 5.5.0 through 5.5.27 and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter related to \invalid HTML.\


Cross-site scripting (XSS) vulnerability in password.php in Scripts for Sites EZ Reminder allows remote attackers to inject arbitrary web script or HTML via unspecified vectors possibly involving the u2 parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via invalid Cascading Style Sheets (CSS) expressions in the style attribute which is processed by Internet Explorer 7.


Cross-site scripting (XSS) vulnerability in the sajax_get_common_js function in php/Sajax.php in Sajax 0.12 allows remote attackers to inject arbitrary web script or HTML via the URL parameter which is not properly handled when using browsers that do not URL-encode requests such as Internet Explorer 6. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 12.4(23) allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) level/15/exec/-/ or (2) exec/ a different vulnerability than CVE-2008-3821.


Bugzilla 2.x before 2.22.7 3.0 before 3.0.7 3.2 before 3.2.1 and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting (XSS) and related attacks by uploading HTML and JavaScript attachments that are rendered by web browsers.


Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0.x before 1.0.11 and 1.1.x before 1.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the introduction field in a user profile or (2) an arbitrary text block in a user view.


Cross-site scripting (XSS) vulnerability in ScriptsEz Ez PHP Comment allows remote attackers to inject arbitrary web script or HTML via the name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in /prm/reports in the Performance Reporting Module (PRM) for Sun Management Center (SunMC) 3.6.1 and 4.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: this can be leveraged for access to the SunMC Web Console.


Cross-site scripting (XSS) vulnerability in the taxonomy_theme_admin_table_builder function (taxonomy_theme_admin.inc) in Taxonomy Theme module before 5.x-1.2 a module for Drupal allows remote authenticated users with the \administer taxonomy\ permission or the ability to create pages when tagging is enabled to inject arbitrary web script or HTML via the Vocabulary name (name parameter) to index.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in course/lib.php in Moodle 1.6 before 1.6.9 1.7 before 1.7.7 1.8 before 1.8.8 and 1.9 before 1.9.4 allows remote attackers to inject arbitrary web script or HTML via crafted log table information that is not properly handled when it is displayed in a log report.


Multiple cross-site scripting (XSS) vulnerabilities in PHPFootball 1.6 allow remote attackers to inject arbitrary web script or HTML via (1) the user parameter to login.php or (2) the dbfield parameter to filter.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the hook_cntrlr_error_output function in modules/page/hooks/listeners.php in the admincp component in TangoCMS 2.2.x (aka Eagle) before 2.2.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the edit account page in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6.0 MR4) and 7.0 before 7.0(2) (aka 7.0 MR1) allows remote authenticated users to inject arbitrary web script or HTML via the E-mail Address field.


Multiple cross-site scripting (XSS) vulnerabilities in sample applications in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 and 6.1 before 6.1.0.23 on z/OS allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).


Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006 2006 Supportability Update and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via \authentication input\ to this component aka \Cross-Site Scripting Vulnerability.\


Cross-site scripting (XSS) vulnerability in QuoteBook allows remote attackers to inject arbitrary web script or HTML via the (1) QuoteName and (2) QuoteText parameters to quotesadd.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in index.php in the Link module 5.x-2.5 for Drupal 5.10 allows remote authenticated users with \administer content types\ privileges to inject arbitrary web script or HTML via the description parameter (aka the Help field). NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in DFLabs PTK 1.0.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML by providing a forensic image containing HTML documents which are rendered in web browsers during inspection by PTK. NOTE: the vendor states that the product is intended for use in a laboratory with \no contact from / to internet.\


International Components for Unicode (ICU) 4.0 3.6 and other 3.x versions as used in Apple Mac OS X 10.5 before 10.5.7 iPhone OS 1.0 through 2.2.1 iPhone OS for iPod touch 1.1 through 2.2.1 Fedora 9 and 10 and possibly other operating systems does not properly handle invalid byte sequences during Unicode conversion which might allow remote attackers to conduct cross-site scripting (XSS) attacks.


Cross-site scripting (XSS) vulnerability in the AgaviWebRouting::gen(null) method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not strictly follow RFC 3986 such as Internet Explorer 6 and 7.


Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2 a module for Drupal allow remote authenticated users with \administer workflow\ privileges to inject arbitrary web script or HTML via the name of a (1) workflow or (2) workflow state.


Dan Pascu python-cjson 1.0.5 does not properly handle a '/' argument to cjson.encode which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firefox and the end tag of a SCRIPT element.


Cross-site

scripting

(XSS)

vulnerability

in

the

function

in

Ruby

on

Rails

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

vectors

involving

non-printing

ASCII

characters

related

to

HTML::Tokenizer

and


Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authenticated users with permissions to create new menus to inject arbitrary web script or HTML via a menu description which is not properly handled in the menu administration overview.


Cross-site scripting (XSS) vulnerability in searchresults_main.php in ZeeLyrics 3x allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

Ektron

and

and

possibly

through

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

css

eca

id

and

skin

parameters.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Multiple cross-site scripting (XSS) vulnerabilities in PHD Help Desk 1.43 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to area.php; the (2) pagina (3) sentido (4) q_registros and (5) orden parameters to area.php; (6) the q_registros parameter to solic_display.php; (7) the PATH_INFO to area_list.php; (8) the q_registros parameter to area_list.php; (9) the PATH_INFO to atributo.php; the (10) pagina (11) q_registros and (12) orden parameters to atributo_list.php; (13) an arbitrary parameter name beginning with \sentido\ to atributo_list.php; and (14) the PATH_INFO to caso_insert.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ToutVirtual

VirtualIQ

Pro

build

and

build

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

userId

parameter

to

deptName

parameter

to

ID

parameter

to

reportName

parameter

to

or

middleName

parameter

in

a

save

action

to


Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ViArt

Helpdesk

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

products.php

article.php

or

reviews.php;

the

parameter

to

forum.php;

or

the

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter in a sitemap action (2) the search parameter in a search action (3) the tagging_id parameter in a search action (4) the highlight parameter in an artikel action (5) the artlang parameter in an artikel action (6) the letter parameter in a sitemap action (7) the lang parameter in a show action (8) the cat parameter in a show action (9) the newslang parameter in a news action (10) the artlang parameter in a send2friend action (11) the cat parameter in a send2friend action (12) the id parameter in a send2friend action (13) the srclang parameter in a translate action (14) the id parameter in a translate action (15) the cat parameter in a translate action (16) the cat parameter in an add action or (17) the question parameter in an add action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in search.php in phpFK PHP Forum ohne 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to inject arbitrary web script or HTML via (1) the cod_categoria parameter to categoria.php (2) the opcao parameter to index.php and the PATH_INFO to (3) categoria.php and (4) index.php.


Cross-site scripting (XSS) vulnerability in the Contact module in Exponent CMS 0.97-GA20090213 allows remote attackers to inject arbitrary web script or HTML via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Snitz Forums 2000 3.4.07 allow remote attackers to inject arbitrary web script or HTML via (1) the url parameter to pop_send_to_friend.asp related to a crafted onload attribute of an IMG element; or (2) an onload attribute in a sound tag.


Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog allows remote attackers to inject arbitrary web script or HTML via the cname parameter related to the act and id parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors

in

submitnews.php

usersettings.php;

and

newpost.php

banlist.php

banner.php

cpage.php

download.php

frontpage.php

links.php

and

mailout.php

in

NOTE:

this

may

overlap

and

but

there

are

insufficient

details

to

be

certain.


Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php nodayshow parameter to (2) mostvisitpage.php and (3) visitorduration.php in stat/ (4) nopagesmost parameter to stat/mostvisitpagechart.php and date parameter to (5) pageviewers.php (6) pageviewerschart.php and (7) referer.php in stat/.


Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance before 7_0_296 allows remote attackers to inject arbitrary web script or HTML via the username parameter which is not properly handled when the administrator views audit logs.


Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sig1 parameter to base/base_qry_main.php or the time01 parameter to (2) base/base_stat_alerts.php or (3) base/base_stat_uaddr.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in NCH Software Axon Virtual PBX 2.10 and 2.11 allow remote attackers to inject arbitrary web script or HTML via the (1) onok or (2) oncancel parameter to the logon program. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in images.php in Image Hosting Script DPI 1.1 Final (1.1F) allows remote attackers to inject arbitrary web script or HTML via the date parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to jsp/dump.jsp in the JSP Dump feature or the (2) Name or (3) Value parameter to the default URI for the Session Dump Servlet under session/.


Multiple cross-site scripting (XSS) vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script allow remote attackers to inject arbitrary web script or HTML via the (1) search_name and (2) languages parameters. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the Sections module 5.x before 5.x-1.3 and 6.x before 6.x-1.3 for Drupal allows remote authenticated users with \administer sections\ privileges to inject arbitrary web script or HTML via a section name (aka the Name field).


Multiple cross-site scripting (XSS) vulnerabilities in Online Work Order Suite (OWOS) Lite Edition 3.10 allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) default.asp and (2) report.asp and the (3) go parameter to login.asp.


Cross-site scripting (XSS) vulnerability in webkitpart.cpp in kwebkitpart allows remote attackers to inject arbitrary web script or HTML via a URL associated with a nonexistent domain name related to a \universal XSS\ issue a similar vulnerability to CVE-2010-2536.


Cross-site scripting (XSS) vulnerability in the Contact module (modules/contact/contact.admin.inc or modules/contact/contact.module) in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with \administer site-wide contact form\ permissions to inject arbitrary web script or HTML via the contact category name.


Cross-site scripting (XSS) vulnerability in Hitron Soft Answer Me 1.0 allows remote attackers to inject arbitrary web script or HTML via the q_id parameter to the answers script (aka answers.php). NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the Submitted By module 6.x before 6.x-1.3 for Drupal allows remote authenticated users with \administer content types\ privileges to inject arbitrary web script or HTML via an input string for \submitted by\ text.


Cross-site scripting (XSS) vulnerability in the Locale module (modules/locale/locale.module) in Drupal Core 6.14 and possibly other versions including 6.15 allows remote authenticated users with \administer languages\ permissions to inject arbitrary web script or HTML via the (1) Language name in English or (2) Native language name fields in the Custom language form.


Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in moziloCMS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) file parameters in an editsite action different vectors than CVE-2008-6127 and CVE-2009-1367.


Multiple cross-site scripting (XSS) vulnerabilities in oBlog allow remote attackers to inject arbitrary web script or HTML via the (1) commentName (2) commentEmail (3) commentWeb or (4) commentText parameter to article.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via the (5) article_id or (6) title parameter to admin/write.php the (7) category_id or (8) category_name parameter to admin/groups.php the (9) blogroll_id or (10) title parameter to admin/blogroll.php or the (11) blog_name or (12) tag_line parameter to admin/settings.php.


Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to inject arbitrary web script or HTML via the (1) pid parameter in a code action to index.php and the (2) uid parameter in a view action to profile.php.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the (1) uid parameter (2) uid parameter in a login_lookup action (3) uid parameter in an adminlogin action (4) campaignid parameter in a createcampaign action (5) type parameter in a view_account_stats action (6) period parameter in a view_account_stats action (7) uid parameter in a view_adrates action (8) accname parameter in an account_confirmation action (9) loginpass parameter in an account_confirmation action (10) e9 parameter in a setup_account action (11) from parameter in an email_advertisers action (12) message parameter in an email_advertisers action (13) idno parameter in an edit_ad_package action (14) Advertiser Name field (15) First Name field (16) Last Name field (17) Address field (18) Phone Number field (19) Password Hint field or (20) URL field; and (21) allow remote authenticated users to inject arbitrary web script or HTML via an unspecified form associated with a view_adrates action.


Multiple cross-site scripting (XSS) vulnerabilities in the JSF Widget Library Runtime in IBM Rational Application Developer for WebSphere Software before 7.0.0.10 and Rational Software Architect before 7.0.0.10 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) the JSF Tree Control and (2) the JavaScript Resource Servlet.


Cross-site scripting (XSS) vulnerability in the WebVPN portal on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka Bug ID CSCsq78418.


Multiple cross-site scripting (XSS) vulnerabilities in models.parser in PyForum 1.0.3 and possibly earlier versions and possibly zForum allow remote attackers to inject arbitrary web script or HTML via crafted BBcode (1) img or (2) url tags which are not properly handled when a post is viewed.


Cross-site scripting (XSS) vulnerability in Forms/login1 in American Power Conversion (APC) Switched Rack PDU AP7932 B2 running rpdu 3.3.3 or 3.7.0 on AOS 3.3.4 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the login_username parameter.


Multiple cross-site scripting (XSS) vulnerabilities in TransWARE Active! mail 2003 build 2003.0139.0871 and earlier and possibly other versions before 2003.0139.0939 allow remote attackers to inject arbitrary web script or HTML via the (1) From (2) To (3) Cc and (4) Bcc parameters.


Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the Automated Logout module 6.x-1.x before 6.x-1.7 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users with administer autologout privileges to inject arbitrary web script or HTML via unspecified vectors.


The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences (2) invalid Shift_JIS sequences and (3) invalid EUC-JP sequences which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.


in

Horde

Application

Framework

before

Horde

Groupware

before

and

Horde

Groupware

Webmail

Edition

before

does

not

properly

handle

data:

URIs

which

allows

remote

attackers

to

conduct

cross-site

scripting

(XSS)

attacks

via

data:text/html

values

for

the

HREF

attribute

of

an

A

element

in

an

HTML

e-mail

message.

NOTE:

the

vendor

states

that

the

issue

is

caused

by

\an

XSS

vulnerability

in

Firefox

browsers.\


Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) the user parameter to search.php; the (3) cat_msg (4) source_msg (5) postponed_selected (6) unapproved_selected and (7) news_per_page parameters in a list action to the editnews module of index.php; and (8) the link tag in news comments. NOTE: some of the vulnerabilities require register_globals to be enabled and/or magic_quotes_gpc to be disabled.


Opera before 10.10 when exception stacktraces are enabled places scripting error messages from a web site into variables that can be read by a different web site which allows remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Image Assist module 5.x-1.x before 5.x-1.8 5.x-2.x before 2.0-alpha4 6.x-1.x before 6.x-1.1 6.x-2.x before 2.0-alpha4 and 6.x-3.x-dev before 2009-07-15 a module for Drupal allows remote authenticated users with image-node creation privileges to inject arbitrary web script or HTML via a node title.


Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (a) 5 or (b) 9 field in a post action to ticket_function.php reachable through ticket_submit.php and index.php; (c) the which parameter to function.php or (d) the which parameter to index.php related to knowledgebase_list.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/ (2) jspsnoop/ERROR/ and (3) jspsnoop/IOException/ and possibly the PATH_INFO to (4) snoop.jsp.


Cross-site scripting (XSS) vulnerability in search.cgi in Matt's Script Archive (MSA) Simple Search 1.0 allows remote attackers to inject arbitrary web script or HTML via the terms parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in x10 Adult Media Script 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php (2) category parameter to linkvideos_listing.php (3) id parameter to templates/header1.php and (4) key parameter to video_listing.php.


Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12 and possibly other versions before 0.9.16.014 allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the \phpgw_\ sequence.


Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT) before 2.5.0 as used in KonaKart and other products allows remote attackers to inject arbitrary web script or HTML via the __report parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE) possibly 1.4.4 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) admin/base_roleadmin.php (2) admin/base_useradmin.php (3) base_conf_contents.php (4) base_qry_sqlcalls.php and (5) base_ag_main.php.


Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page which may be interpreted as script by Internet Explorer 7 and 8.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

multiple

scripts

in

Forms/

in

Huawei

ARG-T

running

firmware

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

BackButton

parameter

to

wzConnFlag

parameter

to

and

DiagStartFlag

parameters

to

and

wzdmzHostIP

parameters

to

and

parameters

to

and

parameters

to

and

wzFirstFlag

parameters

to

and

wzConnectFlag

parameter

to


Cross-site scripting (XSS) vulnerability in the Print (aka Printer e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9 a module for Drupal allows remote attackers to inject arbitrary web script or HTML via crafted data in a list of links.


Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) graph.php (2) include/top_graph_header.php (3) lib/html_form.php and (4) lib/timespan_settings.php as demonstrated by the (a) graph_end or (b) graph_start parameters to graph.php; (c) the date1 parameter in a tree action to graph_view.php; and the (d) page_refresh and (e) default_dual_pane_width parameters to graph_settings.php.


Cross-site scripting (XSS) vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1 a module for Drupal allows remote authenticated users with \create application\ privileges to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the Webee Comments (com_webeecomment) component 1.1.1 1.2 and 2.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) color (2) img or (3) url BBCode tags in unspecified vectors.


Cross-site scripting (XSS) vulnerability in webview.cpp in QtDemoBrowser allows remote attackers to inject arbitrary web script or HTML via a URL associated with a nonexistent domain name related to a \universal XSS\ issue a similar vulnerability to CVE-2010-2536.


Multiple cross-site scripting (XSS) vulnerabilities in the Joomulus (mod_joomulus) module 2.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action to (1) tagcloud_ell.swf (2) tagcloud_eng.swf (3) tagcloud_por.swf (4) tagcloud_rus.swf and possibly (5) tagcloud_jpn.swf. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in ATRC ACollab 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) address parameter to profile.php or the (2) description parameter to events/add_event.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to inject arbitrary web script or HTML via the fid parameter in a view_forum action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

ToutVirtual

VirtualIQ

Pro

build

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

addNewDept

deptId

or

deptDesc

parameter

to

or

the

firstName

lastName

or

email

parameter

in

a

save

action

to

NOTE:

the

provenance

of

this

information

is

unknown;

the

details

are

obtained

solely

from

third

party

information.


Multiple cross-site scripting (XSS) vulnerabilities in Online Contact Manager (formerly EContact PRO) 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) showGroup parameter to (a) index.php and the (2) id parameter to (b) view.php (c) email.php (d) edit.php and (e) delete.php.


Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2 and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin/admin/config.php during a trunks display action the (2) description parameter during an Add Zap Channel action and (3) unspecified vectors during an Add Recordings action.


The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for malicious inputs which allows remote attackers to inject arbitrary web script or HTML via the searchtext parameter and other unspecified inputs.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in Plohni Shoutbox 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) input_name and (2) input_text parameters. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the GetURLArguments function in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow remote attackers to inject arbitrary web script or HTML via a key to csim_in_html_ex1.php and other unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in the ProofReader (com_proofreader) component 1.0 RC9 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the URI which is not properly handled in (1) 404 or (2) error pages.


The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to leverage the \response-changing mechanism\ to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities related to the details of output encoding and improper modification of an HTML attribute aka \XSS Filter Script Handling Vulnerability.\


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

TestLink

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

req

parameter

to

login.php

and

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

key

parameter

to

the

tableName

parameter

to

or

the

startDate

endDate

or

logLevel

parameter

to

the

parameter

to

or

the

name

steps

or

summary

parameter

in

a

find

action

to

related

to


Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b when magic_quotes_gpc is disabled allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action.


Multiple cross-site scripting (XSS) vulnerabilities in SemanticScuttle before 0.94.1 allow remote attackers to inject arbitrary web script or HTML via the sort parameter to index.php and other unspecified vectors a different issue than CVE-2008-6113. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Theeta CMS possibly 0.01 allow remote attackers to inject arbitrary web script or HTML via the (1) start (2) forum and (3) cat parameters to community/thread.php; (4) start and (5) cat parameters to community/forum.php; and (6) start parameter to blog/index.php.


Multiple cross-site scripting (XSS) vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated users to inject arbitrary web script or HTML via the (1) skype (2) yahoo (3) aol (4) msn or (5) jabber parameter in a profile2 action. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in index.php in oBlog allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in map.php in LiveZilla 3.1.8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) lat (2) lng and (3) zom parameters which are not properly handled when processed with templates/map.tpl.


Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 when register_globals is enabled and magic_quotes_gpc is disabled allow remote attackers to inject arbitrary web script or HTML via the (1) lastusername and (2) mod parameters to index.php; and (3) the title parameter to search.php.


Cross-site scripting (XSS) vulnerability in modules/mod_yj_whois.php in the YJ Whois component 1.0x and 1.5.x for Joomla! allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php. NOTE: some of these details are obtained from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Pligg

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

HTTP

Referer

header

to

delete.php

editlink.php

submit.php

and


Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string a different vulnerability than CVE-2010-1210.


The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 text to the 404 error page of a Project Woodstock service on this port.


Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x before 4.0.2.3-P8AE-FP003 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to .jsp pages.


ModSecurity before 2.5.11 treats request parameter values containing single quotes as files which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header.


Cross-site scripting (XSS) vulnerability in the secure redirect function of RSA ACE/Agent 5.0 for Windows and 5.x for Web allows remote attackers to insert arbitrary web script and possibly cause users to enter a passphrase via a GET request containing the script.


Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary web script via a URL containing the script in the domain name portion which is not properly cleansed in the default error pages (1) 500.htm for \500 Internal Server error\ or (2) 404.htm for \404 Not Found.\


Multiple cross-site scripting (XSS) vulnerabilities in phpWebSite 0.9.x and earlier allow remote attackers to execute arbitrary web script via (1) the day parameter in the calendar module (2) the fatcat_id parameter in the fatcat module (3) the PAGE_id parameter in the pagemaster module (4) the PDA_limit parameter in the search and (5) possibly other parameters in the calendar fatcat and pagemaster modules.


Cross-site scripting (XSS) vulnerability in parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to insert arbitrary script via the filename parameter which is inserted into an error message.


Cross-site scripting (XSS) vulnerability in Movable Type before 2.6 and possibly other versions including 2.63 allows remote attackers to insert arbitrary web script or HTML via the Name textbox possibly when the \Allow HTML in comments?\ option is enabled.


Cross-site scripting (XSS) in Internet Explorer 5.5 and 6.0 possibly in a component that is also used by other Microsoft products allows remote attackers to insert arbitrary web script via an XML file that contains a parse error which inserts the script in the resulting error message.


Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1) the file root or rev parameters to cvslog.cgi (2) the file or root parameters to cvsblame.cgi (3) various parameters to cvsquery.cgi (4) the person parameter to showcheckins.cgi (5) the module parameter to cvsqueryform.cgi and (6) possibly other attack vectors as identified by Mozilla bug #146244.


Multiple cross-site scripting (XSS) vulnerabilities in WebLogic Integration 7.0 and 2.0 Liquid Data 1.1 and WebLogic Server and Express 5.1 through 7.0 allow remote attackers to execute arbitrary web script and steal authentication credentials via (1) a forward instruction to the Servlet container or (2) other vulnerabilities in the WebLogic Server console application.


Microsoft ASP.Net 1.1 allows remote attackers to bypass the Cross-Site Scripting (XSS) and Script Injection protection feature via a null character in the beginning of a tag name.


FreeScripts VisitorBook LE (visitorbook.pl) logs the reverse DNS name of a visiting host which allows remote attackers to spoof the origin of their incoming requests and facilitate cross-site scripting (XSS) attacks.


Multiple cross-site scripting vulnerabilities (XSS) in Bugzilla 2.16.x before 2.16.3 and 2.17.x before 2.17.4 allow remote attackers to insert arbitrary HTML or web script via (1) multiple default German and Russian HTML templates or (2) ALT and NAME attributes in AREA tags as used by the GraphViz graph generation feature for local dependency graphs.


Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors screens.


Cross-site scripting (XSS) vulnerability in index.cgi for Bandmin 1.4 allows remote attackers to insert arbitrary HTML or script via (1) the year parameter in a showmonth action (2) the month parameter in a showmonth action or (3) the host parameter in a showhost action.


Cross-site scripting (XSS) vulnerability in FreeScripts VisitorBook LE (visitorbook.pl) allows remote attackers to inject arbitrary HTML or web script via (1) the \do\ parameter (2) via the \user\ parameter from a host with a malicious reverse DNS name (3) via quote marks or ampersands in other parameters.


Cross-site scripting (XSS) vulnerability in the webapps-simple sample application for (1) Sun ONE Application Server 7.0 for Windows 2000/XP or (2) Sun Java System Web Server 6.1 allows remote attackers to insert arbitrary web script or HTML via an HTTP request that generates an \Invalid JSP file\ error which inserts the text in the resulting error message.


Cross-site scripting vulnerability (XSS) in (1) admin_index.php (2) admin_pass.php (3) admin_modif.php and (4) admin_suppr.php in MyGuestbook 3.0 allows remote attackers to execute arbitrary PHP code by modifying the location parameter to reference a URL on a remote web server that contains file.php via script injected into the pseudo email and message parameters.


Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5 when DNS resolution is enabled for client IP addresses allows remote attackers to inject arbitrary text into log files and conduct cross-site scripting (XSS) attacks involving the iPlanet Log Analyzer via an HTTP request in conjunction with a crafted DNS response related to an \Inverse Lookup Log Corruption (ILLC)\ issue a different vulnerability than CVE-2002-1315 and CVE-2002-1316.


Cross-site scripting (XSS) vulnerability in Bajie Java HTTP Server 0.95 through 0.95zxv4 allows remote attackers to inject arbitrary web script or HTML via (1) the query string to test.txt (2) the guestName parameter to the custMsg servlet or (3) the cookiename parameter to the CookieExample servlet.


Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server before 6.0 beta 6 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) isapi/testisa.dll (2) testcgi.exe (3) environ.pl (4) the query parameter to samples/search.dll (5) the price parameter to mortgage.pl (6) the query string in dumpenv.pl (7) the query string to dumpenv.pl and (8) the E-Mail field of the guestbook script (book.pl).


Cross-site scripting (XSS) vulnerability in mod.php in eNdonesia 8.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerabilities in Yet Another Bulletin Board (YaBB) 1.5.0 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via cookies by injecting arbitrary HTML or script into (1) news_icon of news_template.php and (2) threadid and subject of index.html


Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.12 BETA and earlier allow remote attackers to execute script on other clients via (1) the link parameter in sectionswindow.php the directory parameter in (2) gallery.php (3) navigation.php or (4) uploadimage.php the path parameter in (5) view.php (6) the choice parameter in upload.php (7) the sitename parameter in mambosimple.php (8) the type parameter in upload.php or the id parameter in (9) emailarticle.php (10) emailfaq.php or (11) emailnews.php.


Multiple cross-site scripting (XSS) vulnerabilities in Nuked-Klan 1.2b allow remote attackers to inject arbitrary HTML or web script via (1) the Author field in the Guestbook module (2) the Titre or Pseudo fields in the Forum module or (3) \La Tribune Libre\ in the Shoutbox module.


Multiple cross-site scripting (XSS) vulnerabilities in example scripts in Caucho Technology Resin 2.0 through 2.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) env.jsp (2) form.jsp (3) session.jsp (4) the move parameter to tictactoe.jsp or the (5) name or (6) comment fields to guestbook.jsp.


Netscape Communicator 4.04 through 4.7 (and possibly other versions) in various UNIX operating systems converts the 0x8b character to a \<\ sign and the 0x9b character to a \>\ sign which could allow remote attackers to attack other clients via cross-site scripting (CSS) in CGI programs that do not filter these characters.


Validate-Before-Canonicalize vulnerability in the checkURI function in functions.inc.php in PHPX 3.0 through 3.2.6 allows remote attackers to conduct cross-site scripting (XSS) attacks via hex-encoded tags which bypass the check for literal \<\ \>\ \(\ and \)\ characters as demonstrated using the limit parameter to forums.php and a variety of other vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Turbo Traffic Trader C (TTT-C) 1.0 allow remote attackers to inject arbitrary HTML or web script as demonstrated via (1) the link parameter to ttt-out (2) the X-Forwarded-For header in a GET request to ttt-in (3) the Referer header in a GET request to ttt-in or the (4) site name or (5) site URL fields in the main control panel.


Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter which is checked for dangerous sequences before it is canonicalized leading to a cross-site scripting (XSS) vulnerability.


Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 parameter to clock_menu.php (2) \email article to a friend\ field (3) \submit news\ field or (4) avmsg parameter to usersettings.php.


Multiple cross-site scripting (XSS) vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web script or HTML via (1) a hex-encoded value to the variable parameter in emumail.fcgi (2) the folder parameter in emumail.fcgi or Javascript in the (3) username or (4) password field in the login page.


Multiple cross-site scripting (XSS) vulnerabilities in LiveWorld products possibly including (1) LiveForum (2) LiveQ&A (3) LiveChat and (4) LiveFocusGroup allow remote attackers to inject arbitrary web script or HTML via the q parameter in (a) search.jsp (b) findclub!execute.jspa and (c) search!execute.jspa.


Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in (a) search.php (2) the email parameter in (b) subscribe.php and (3) the return and (4) title parameters in (c) forum_2.php.


Multiple cross-site scripting (XSS) vulnerabilities in mod.php in eNdonesia 8.3 allow remote attackers to inject arbitrary web script or HTML via (1) the mod parameter in a viewcat operation or (2) the query parameter in a search operation in the publisher module.


The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier 7.0 SP4 and earlier 6.1 through SP6 and 5.1 through SP13 responds to the HTTP TRACE request which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.


Cross-site

scripting

(XSS)

vulnerability

in

and

earlier

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

parameter

in

SetPreferences.cgi;

BRANCH

parameter

in

branchView.cgi;

FSPC

and

COMPLETE

parameters

in

changeByUsers.cgi;

FSPC

LABEL

EXLABEL

STATUS

MAXCH

FIRSTCH

CHOFFSETDISP

SEARCHDESC

USER

GROUP

and

CLIENT

parameters

in

changeList.cgi;

CH

parameter

in

changeView.cgi;

USER

parameter

in

clientList.cgi;

CLIENT

parameter

in

clientView.cgi;

FSPC

parameter

in

depotTreeBrowser.cgi;

FSPC

parameter

in

depotStats.cgi;

FSPC

REV

ACT

CH

and

CONTEXT

parameters

in

fileDiffView.cgi;

FSPC

and

REV

parameters

in

fileDownLoad.cgi;

FSPC

LISTLAB

and

SHOWBRANCH

parameters

in

fileLogView.cgi;

FSPC

and

LABEL

parameters

in

fileSearch.cgi;

FSPC

REV

and

FORCE

parameters

in

fileViewer.cgi;

FSPC

parameter

in

filesChangedSince.cgi;

GROUP

parameter

in

groupView.cgi;

TYPE

FSPC

and

REV

parameters

in

htmlFileView.cgi;

CMD

parameter

in

javaDataView.cgi;

JOBVIEW

and

FLD

parameters

in

jobList.cgi;

JOB

parameter

in

jobView.cgi;

and

parameters

in

labelDiffView.cgi;

LABEL

parameter

in

labelView.cgi;

FSPC

parameter

in

searchPattern.cgi;

TYPE

FSPC

and

REV

parameters

in

specialFileView.cgi;

GROUPSONLY

parameter

in

userList.cgi;

or

USER

parameter

in

userView.cgi.


Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the \attachment\ parameter in the Content-Disposition field for attachments which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link which facilitates cross-site scripting (XSS) and possibly other attacks.


The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.


Cross-site scripting (XSS) vulnerability in Google Toolbar 2.0.114.1 allows remote attackers to inject arbitrary web script via about.html in the About section. NOTE: some followup posts suggest that the demonstration code's use of the res:// protocol does not cross privilege boundaries since it is not allowed in the Internet Zone. Thus this might not be a vulnerability.


Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the year (2) month and (3) day parameters in calendar.php; (4) the cid and (5) url parameters in index.php; (6) the cid parameter in annoucement.php; (7) the cid parameter in news.php; (8) the cid parameter in contents.php; (9) the q parameter in search.php; and (10) the country parameter in register.php.


Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some sources have reported that the affected file is read.php but this is inconsistent with the vendor's patch.


Serena TeamTrack 6.1.1 allows remote attackers to obtain sensitive information such as user names versions and database information and conduct cross-site scripting (XSS) attacks via a direct request to tmtrack.dll with modified LoginPage and Template parameters.


Multiple cross-site scripting (XSS) vulnerabilities in Brad Fears phpCodeCabinet 0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple parameters including (1) the sid parameter to comments.php (2) the cid cf or rfd parameters to category.php or the cid parameter to (3) input.php (4) browse.php (5) themes/facade/header.php or (6) themes/phpcc/header.php.


Multiple cross-site scripting vulnerabilities in ASPRunner 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) SearchFor parameter in TABLE-NAME_search.asp (2) SQL parameter in TABLE-NAME_edit.asp (3) SearchFor parameter in TABLE_list.asp or (4) SQL parameter in export.asp.


Multiple cross-site scripting (XSS) vulnerabilities in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) before R_2_5_0_41 allow remote attackers to inject arbitrary web script or HTML via (1) the topic parameter in search.pl and (2) the filter parameter in submit.pl.


Cross-site scripting (XSS) vulnerability in Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02 when Internet Explorer is used allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message a different vulnerability than CVE-2005-2022 and CVE-2006-5486.


The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs which allows remote attackers to conduct cross-site scripting (XSS) attacks that do not use <script> tags as demonstrated via javascript in IMG tags to (1) the cat parameter in shopdisplayproducts.asp or (2) the msg parameter in shoperror.asp and possibly other vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Express-Web Content Management System (CMS) allow remote attackers to steal cookie-based authentication information and possibly perform other exploits via the (1) n (2) b (3) e or (4) a parameters to default.asp (5) the Referer header in an HTTP request to login.asp or (6) the email parameter to subscribe/default.asp.


Multiple cross-site scripting (XSS) vulnerabilities in Nextplace.com E-Commerce ASP Engine allow remote attackers to inject arbitrary web script or HTML via the (1) level parameter of productdetail.asp (2) searchKey parameter of searchresults.asp and possibly (3) level parameter of ListCategories.asp.


Multiple cross-site scripting (XSS) vulnerabilities in NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to inject arbitrary web script or HTML via (a) a URI containing the script or (b) the username field in the login form. NOTE: it is possible that the first attack vector is resultant from the error message issue (CVE-2004-2547).


Cross-site scripting (XSS) vulnerability in GBook for Php-Nuke 1.0 allows remote attackers to inject arbitrary web script or HTML via multiple parameters including (1) name (2) email (3) city and (4) message which do not use the <script> and <style> tags which are filtered by PHP-Nuke.


Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via (1) the UnicodeConverter extension (2) raw page views (3) SpecialIpblocklist (4) SpecialEmailuser (5) SpecialMaintenance and (6) ImagePage.


Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module (3) preview_review function in the Reviews module as demonstrated by the url cover rlanguage and hits parameters or (4) savecomment function in the Reviews module as demonstrated using the uname parameter. NOTE: the Faq/categories and Encyclopedia/ltr issues are already covered by CVE-2005-1023.


Cross-site scripting (XSS) vulnerability in the error handler in Hitachi Web Page Generator and Web Page Generator Enterprise 4.01 and earlier when using the default error template and debug mode is set to ON allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.


Multiple cross-site scripting (XSS) vulnerabilities in WowBB Forum 1.61 allow remote attackers to inject arbitrary web script or HTML via the (1) country parameter to view_user.php (2) show parameter to view_forum.php (3) letter parameter to view_user.php (4) highlight parameter to view_topic.php (5) show parameter to index.php (6) q parameter to search.php (7) Referer header to admin.php or the (8) user_email parameter to login.php.


Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server 6.1 Beta 2 on Windows and possibly other versions on Linux allow remote attackers to inject arbitrary web script or HTML via (1) the show parameter in show.asp and (2) the title parameter in showperf.asp.


SQL injection vulnerability in 4nGuestbook 0.92 for PHP-Nuke 6.5 through 6.9 allows remote attackers to modify SQL statements via the entry parameter to modules.php which can also facilitate cross-site scripting (XSS) attacks when MySQL errors are triggered.


Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attackers to inject arbitrary HTML or web script into the (1) optionbox parameter in the News module (2) date parameter in the Statistics module (3) year month and month_1 parameters in the Stories_Archive module (4) mode order and thold parameters in the Surveys module or (5) a SQL statement to index.php as processed by mainfile.php.


Cross-site scripting (XSS) vulnerability in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to process arbitrary script or HTML as other users via (1) a malformed request for a Perl program with script in the filename (2) the User.id parameter to the webacc servlet (3) the GWAP.version parameter to webacc or (4) a URL request for a .bas file with script in the filename.


Cross-site scripting (XSS) vulnerability in 1st Class Mail Server 4.01 allows remote attackers to inject arbitrary web script or HTML via the Mailbox parameter to (1) viewmail.tagz (2) the index script under /user/ (3) members.tagz (4) general.tagz (5) advanced.tagz or (6) list.tagz.


Cross-site scripting (XSS) vulnerability in Symantec Web Security 2.5 3.0.0 and 3.0.1 before build 62 allows remote attackers to inject arbitrary web script or HTML via the query string in blocked URLs that are listed in (1) error or (2) block page messages.


Cross-site scripting (XSS) vulnerability in AliveSites Forums 2.0 allows remote attackers to inject arbitrary web script or HTML via the (1) forum_id (2) method or (3) forum_title parameters to post.asp (4) the forum_title parameter to forum.asp or (5) the id parameter to post.asp.


** DISPUTED ** NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6 and possibly earlier versions allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1) computed for display (2) computed when composed or (3) computed text element fields. NOTE: the vendor has disputed this issue saying that it is not a problem with Notes/Domino itself but with the applications that do not properly handle this feature.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

WebCalendar

allow

remote

attackers

to

inject

arbitrary

web

script

via

usersel.php

datesel.php

trailer.php

or

styles.php

as

demonstrated

using

img

srg

tags.


Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.726 allows remote attackers to inject arbitrary web script or HTML via the (1) lid and query parameters to the Downloads module (2) query parameter to the Web_links module or (3) hlpfile parameter to openwindow.php.


Cross-site scripting (XSS) vulnerability in Gadu-Gadu build 155 and earlier allows remote attackers to inject arbitrary web script via a URL which is echoed in a popup window that displays a parsing error message a different vulnerability than CVE-2004-1229.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

phpGroupWare

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

type

msg

pos

msgballmsgnum

fldballacctnum

parameters

to

index.php

or

to


Multiple cross-site scripting (XSS) vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to comment_add.asp (2) search parameter to search.asp or (3) n parameter to category_news_headline.asp.


Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to text popupurl or popuptitle parameters to wp-login.php (2) redirect_url parameter to admin-header.php (3) popuptitle popupurl content or post_title parameters to bookmarklet.php (4) cat_ID parameter to categories.php (5) s parameter to edit.php or (6) s or mode parameter to edit-comments.php.


Cross-site scripting (XSS) vulnerability in modules.php in Php-Nuke 7.1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) Your Name field (2) e-mail field (3) nicname field (4) fname parameter (5) ratenum parameter or (6) search field.


Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html (2) file parameter to erredit.html (3) dns parameter to dnslook.html (4) account parameter to ignorelist.html (5) account parameter to showlog.html (6) db parameter to repairdb.html (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm or (9) ip parameter to del.html. NOTE: the dnslook.html vector was later reported to exist in cPanel 10.


Multiple cross-site scripting (XSS) vulnerabilities in Microsoft W3Who ISAPI (w3who.dll) allow remote attackers to inject arbitrary HTML and web script via (1) HTTP headers such as \Connection\ or (2) invalid parameters whose values are echoed in the resulting error message.


Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_REFERER parameter to login.php (2) HTTP_REFERER parameter to register.php or (3) target parameter to profile.php.


Multiple cross-site scripting (XSS) vulnerabilities in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the (1) screen parameter to modules.php (2) module_name parameter to title.php (3) sortby parameter to modules.php or (4) overview parameter to modules.php.


Multiple cross-site scripting (XSS) vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via via the (1) theme parameter to tiki-switch_theme.php (2) find and priority parameters to messu-mailbox.php (3) flag priority flagval sort_mode or find parameters to messu-read.php (4) articleId parameter to tiki-read_article.php (5) parentId parameter to tiki-browse_categories.php (6) comments_threshold parameter to tiki-index.php (7) articleId parameter to tiki-print_article.php (8) galleryId parameter to tiki-list_file_gallery.php (9) galleryId parameter to tiki-upload_file.php (10) faqId parameter to tiki-view_faq.php (11) chartId parameter to tiki-view_chart.php or (12) surveyId parameter to tiki-survey_stats_survey.php.


Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ppuser (2) password (3) stype (4) perpage (5) sort (6) page (7) si or (8) cat parameters to showmembers.php or the (9) photo name (10) photo description (11) album name or (12) album description fields.


Cross-site scripting (XSS) vulnerability in the administration panel in bBlog 0.7.2 allows remote authenticated users with superuser privileges to inject arbitrary web script or HTML via a blog name ($blogname). NOTE: if administrators are normally allowed to add HTML by other means e.g. through Smarty templates then this issue would not give any additional privileges and thus would not be considered a vulnerability.


Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.0.00.003 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) date or search text field in the calendar module (2) Field parameter Filter parameter QField parameter Start parameter or Search field in the address module (3) Subject field in the message module or (4) Subject field in the Ticket module.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter (2) the zero_rows parameter in read_dump.php (3) the confirm form or (4) an error message generated by the internal phpMyAdmin parser.


Multiple cross-site scripting (XSS) vulnerabilities in Merak Webmail Server 5.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) category (2) cserver (3) ext (4) global (5) showgroups (6) or showlite parameters to address.html or the (7) spage or (8) autoresponder parameters to settings.html the (9) folder parameter to readmail.html or the (10) attachmentpage_text_error parameter to attachment.html (11) folder (12) ct or (13) cv parameters to calendar.html (14) an <img> tag or (15) the subject of an e-mail message.


Cross-site scripting (XSS) vulnerability in Mantis bugtracker allows remote attackers to inject arbitrary web script or HTML via (1) the return parameter to login_page.php (2) e-mail field in signup.php (3) action parameter to login_select_proj_page.php or (4) hide_status parameter to view_all_set.php.


Cross-site scripting (XSS) vulnerability in MERAK Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to execute arbitrary web script or HTML via the (1) User name parameter to accountsettings.html or (2) Search string parameter to search.html.


Multiple cross-site scripting (XSS) vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) redirect parameter to member.php (2) to parameter to myhome.php (3) TID parameter to post.php or (4) redirect parameter to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in w-Agora 4.1.6a allow remote attackers to execute arbitrary web script or HTML via the (1) thread parameter to download_thread.php (2) loginuser parameter to login.php or (3) userid parameter to forgot_password.php.


Cross-site scripting (XSS) vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab (\%09\) character which prevents the rest of the query from being properly sanitized.


Multiple cross-site scripting (XSS) vulnerabilities in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allow remote attackers to inject arbitrary web script or HTML via (1) the u2uheader parameter in editprofile.php the restrict parameter in (2) member.php (3) misc.php and (4) today.php and (5) an arbitrary parameter in phpinfo.php.


Cross-site scripting (XSS) vulnerability in standard_error_message.dtml for Zwiki after 0.10.0rc1 to 0.36.2 allows remote attackers to inject arbitrary HTML and web script via a malformed URL which is not properly cleansed when generating an error message.


Multiple cross-site scripting (XSS) vulnerabilities in error.php in Gijza.net Error Manager 2.1 for PHP-Nuke 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) pagetitle or (2) error parameters or (3) certain parameters in the error log.


Multiple cross-site scripting (XSS) vulnerabilities in Extreme Messageboard (XMB) 1.8 SP3 and 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the (1) xmbuser parameter to xmb.php (2) folder parameter to u2u.php (3) viewmost replymost or latest parameter to stats.php (4) message or icons parameter to post.php (5) threadlist pagelinks forumlist navigation or (6) forumdisplay parameter to forumdisplay.php.


Multiple cross-site scripting (XSS) vulnerabilities in the registration page in phpScheduleIt 1.0.0 RC1 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Lastname fields during new user registration or (3) the Schedule Name field.


Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via (1) the mainnews parameter in admin.php (2) the expand parameter in admin.php (3) the id parameter in admin.php (4) the catid parameter in admin.php or (5) an unnamed parameter during the newslogo_upload action in admin.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

phpGedView

before

allow

remote

attackers

to

inject

arbitrary

HTML

or

web

script

via

descendancy.php

index.php

individual.php

login.php

relationship.php

source.php

imageview.php

calendar.php

gedrecord.php

login.php

and

NOTE:

some

aspects

of

vector

were

later

reported

to

affect


Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users via the (1) member parameter in member.php (2) uid parameter in u2uadmin.php (3) user parameter in editprofile.php (4) an onmouseover event in an align tag when bbcode is allowed or (5) img tag where bbcode is allowed.


Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via (1) the phorum_check_xss function in common.php (2) the EditError variable in profile.php and (3) the Error variable in login.php.


Multiple

cross-site

scripting

vulnerabilities

in

index.php

in

the

Search

module

for

Php-Nuke

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

sid

max

match

or

parameters.


Cross-site scripting (XSS) vulnerability in the print_header_uc function for SqWebMail 4.0.4 and earlier and possibly 3.x allows remote attackers to inject arbitrary web script or HRML via (1) e-mail headers or (2) a message with a \message/delivery-status\ MIME Content-Type.


Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php (2) the $senderNames_part variable in mailbox_display.php and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable.


The strip_tags function in PHP 4.x up to 4.3.7 and 5.x up to 5.0.0RC3 does not filter null (\\0) characters within tag names when restricting input to allowed tags which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.


Multiple cross-site scripting (XSS) vulnerabilities in the primary and management web interfaces in Netegrity IdentityMinder Web Edition 5.6 allows remote attackers to execute script as other users via (1) script that starts with %00 in the numOfExpressions parameter or (2) the mobjtype parameter.


Cross-site scripting (XSS) vulnerability in D-Link DI-614+ SOHO router running firmware 2.30 and DI-704 SOHO router running firmware 2.60B2 and DI-624 allows remote attackers to inject arbitrary script or HTML via the DHCP HOSTNAME option in a DHCP request.


Cross-site scripting (XSS) vulnerability in LAN SUITE Web Mail 602Pro allows remote attackers to execute arbitrary script or HTML as other users via a URL to index.html followed by a / (slash) and the desired script. NOTE: the vendor states that this bug could not be reproduced so this issue may be REJECTed in the future.


Mozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded allowing it to interact with the previous page (zombie document) and enable cross-domain and cross-site scripting (XSS) attacks as demonstrated using onmousemove events.


Unknown vulnerability in Horde IMP 3.2.3 and earlier before a \security fix \ does not properly validate input which allows remote attackers to execute arbitrary script as other users via script or HTML in an e-mail message possibly triggering a cross-site scripting (XSS) vulnerability.


Cross-site scripting (XSS) vulnerability in modules.php in PowerPortal 1.x allows remote attackers to inject arbitrary script or HTML via the (1) id parameter to the (a) private_messages module; (2) search parameter to the (b) links and (c) content modules; and (3) files parameter to the gallery module.


Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors including the mailbox parameter in compose.php.


Multiple cross-site scripting (XSS) vulnerabilities in PhpBB 2.0.8 allow remote attackers to inject arbitrary web script or HTML via (1) the cat_title parameter in index.php (2) the faq00 parameter in lang_faq.php as accessible from faq.php or (3) the faq00 parameter in lang_bbcode.php as accessible from faq.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

editcomponents.cgi

editgroups.cgi

editmilestones.cgi

editproducts.cgi

editusers.cgi

and

editversions.cgi

in

Bugzilla

before

and

before

allow

remote

attackers

to

execute

arbitrary

JavaScript

as

other

users

via

a

URL

parameter.


** DISPUTED ** NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in register.php for unknown versions of vBulletin allows remote attackers to inject arbitrary HTML or web script via the reg_site (or possibly regsite) parameter. NOTE: the vendor has disputed this issue saying \There is no hidden field called 'reg_site' nor any $reg_site variable anywhere in the vBulletin 2 or vBulletin 3 source code or templates nor has it ever existed. We can only assume that this vulnerability was found in a site running code modified from that supplied by Jelsoft.\


The check_referer() function in Formmail.php 5.0 and earlier allows remote attackers to bypass access restrictions via an empty or spoofed HTTP Referer as demonstrated using an application on the same web server that contains a cross-site scripting (XSS) issue.


Cross-site scripting (XSS) vulnerability in the Management Service for Symantec Gateway Security 2.0 allows remote attackers to steal cookies and hijack a management session via a /sgmi URL that contains malicious script which is not quoted in the resulting error page.


Multiple cross-site scripting vulnerabilities (XSS) in MaxWebPortal allow remote attackers to execute arbitrary web script as other users via (1) the sub_name parameter of dl_showall.asp (2) the SendTo parameter in Personal Messages (3) the HTTP_REFERER for down.asp or (4) the image name of an Avatar in the register form.


Multiple cross-site scripting (XSS) vulnerabilities in (1) comersus_customerAuthenticateForm.asp (2) comersus_backoffice_message.asp (3) comersus_supportError.asp or (4) comersus_message.asp in Comersus Cart 5.09 allow remote attackers to execute web script as other users via the message parameter.


Cross-site scripting vulnerability (XSS) in PHPX 3.2.3 allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into (1) keywords argument of main.inc.php (2) body argument of help.inc.php or (3) the subject field in Personal Messages and Forum.


IBM Jazz based applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124355.


IBM Business Process Manager 7.5 8.0 and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130409.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132493.


IBM WebSphere Application Server 7.0 8.0 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997743


IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system including cross-site scripting cache poisoning or session hijacking. IBM X-Force ID: 131396.


IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128692.


IBM Content Navigator 2.0.3 and 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126233.


IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131763.


IBM OpenPages GRC Platform 7.1 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 122200.


IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134637.


IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134814.


IBM DOORS Next Generation (DNG/RRC) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128460.


IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response once the URL is clicked. This would allow the attacker to perform further attacks such as Web cache poisoning cross-site scripting and possibly obtain sensitive information. IBM X-Force ID: 125152.


IBM RELM 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126243.


IBM Campaign 9.1 9.1.2 and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121152.


IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131769.


IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137037.


IBM TRIRIGA Application Platform 3.3 3.4 and 3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126865.


IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128110.


IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132927.


IBM Quality Manager (RQM) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120661.


IBM InfoSphere Information Server 9.1 11.3 and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125916.


IBM Rational Software Architect Design Manager 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124580.


IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134063.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124759.


IBM Connections 5.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129020.


IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133260.


IBM Quality Manager (RQM) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120666.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134065.


IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133178.


IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125976.


IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136152.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125725.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125161.


IBM DOORS Next Generation (DNG/RRC) 4.07 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130915.


IBM Rational DOORS Next Generation 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137038.


IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133379.


IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123857


IBM DOORS Next Generation (DNG/RRC) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126246.


IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 and 9.5) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129831.


IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128170.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124750.


IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136006.


IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134909.


IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128623.


IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127579.


IBM Quality Manager (RQM) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120662.


IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125732.


IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134064.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124758.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133261.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134066.


IBM RELM 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125975.


IBM DOORS Next Generation (DNG/RRC) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134000.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125727.


IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133259.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125155.


IBM Business Process Manager 7.5 8.0 and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130410.


IBM DOORS Next Generation (DNG/RRC) 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132494.


IBM Team Concert (RTC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126856.


IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131397.


IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000152.


IBM Curam Social Program Management 6.0.5 6.1.1 6.2.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134921.


IBM Worklight (IBM MobileFirst Platform Foundation 6.3 7.0 7.1 and 8.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136786.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131761.


IBM Content Navigator 2.0.3 and 3.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999736.


IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130677.


IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123678.


IBM OpenPages GRC Platform 7.1 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125151.


IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120658.


IBM RELM 4.0 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126242.


IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force 124630.