Multiple cross-site scripting (XSS) vulnerabilities in NatterChat 1.12 allow remote attackers to inject arbitrary web script or HTML via the (1) txtUsername parameter to registerDo.asp as invoked from register.asp or (2) txtRoomName parameter to room_new.asp. NOTE: these issues might be resultant from XSS in SQL error messages.


Cross-site

scripting

(XSS)

vulnerability

in

in

MOStlyCE

before

as

used

in

Mambo

and

earlier

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

Command

parameter.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in DevTracker module 3.0 for bcoos 1.1.11 and earlier and DevTracker module 0.20 for E-XooPS 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) direction and (2) order_by parameters.


Multiple cross-site scripting (XSS) vulnerabilities in One-News Beta 2 allow remote attackers to inject arbitrary HTML and web script via the (1) title or (2) content parameters in a news item to add.php and the (3) itemnum (4) author or (5) comment parameters in a comment to index.php. NOTE: vectors 1 and 2 require user authentication.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

LinPHA

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

ftp/index.php

viewer.php

functions/other.php

or


Multiple cross-site scripting (XSS) vulnerabilities in IntraLearn Software IntraLearn 2.1 and possibly other versions before 4.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) outline and (2) course parameters to library/description_link.cfm or the (3) records_to_display and (4) the_start parameters to library/courses_catalog.cfm.


Unspecified vulnerability in Electronic Logbook (ELOG) before 2.7.2 has unknown impact and attack vectors when the \logbook contains HTML code \ probably cross-site scripting (XSS).


Multiple cross-site scripting (XSS) vulnerabilities in Carmosa phpCart 3.4 through 4.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) quantity or (2) Add Engraving fields to the default URI; (3) Quantity field to phpcart.php; (4) Name (5) Company (6) Address (7) City and (8) Province/State fields in a checkout action to phpcart.php; and other unspecified vectors.


Cross-site scripting (XSS) vulnerability in NashTech Easy PHP Calendar 6.3.25 allows remote attackers to inject arbitrary web script or HTML via the Details field (descr parameter) in an Add New Event action in an unspecified request as generated by an add action in index.php.


Multiple cross-site scripting (XSS) vulnerabilities in onlinetools.org EasyImageCatalogue 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) search and (2) d index.php parameters to index.php (3) dir parameter to thumber.php and the d parameter to (4) describe.php and (5) addcomment.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in an unspecified component in Simple Machines phpRaider 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the resistance field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in register.php in FreshScripts Fresh Email Script 1.0 through 1.11 allows remote attackers to inject arbitrary web script or HTML via the Email parameter. NOTE: this can be leveraged to modify cookies and conduct session fixation attacks.


Cross-site scripting (XSS) vulnerability in admin/comments.php in Gelato CMS 0.95 allows remote attackers to inject arbitrary web script or HTML via the content parameter in a comment. NOTE: some of these details are obtained from third party information.


Cross-site

scripting

(XSS)

vulnerability

in

Meridio

Document

and

Records

Management

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

Title

field

in

a

document

(subGeneralProps:dmpvDocTitle:PROP_W_title)

or

container

(subGeneralProps:dmpvContainerTitle:PROP_W_title).


Cross-site scripting (XSS) vulnerability in setup.php in @lex Poll 2.1 allows remote attackers to inject arbitrary web script or HTML via the language_setup parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) files via a certain request with the file parameter set to style.css. NOTE: this can probably be leveraged for cross-site scripting (XSS) attacks.


Multiple cross-site scripting (XSS) vulnerabilities in @lex Guestbook 4.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) language_setup parameter to setup.php or (2) test parameter to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: a third party has been reported that the test parameter is not used in @lex Guestbook.


Multiple cross-site scripting (XSS) vulnerabilities in Lightweight news portal (LNP) 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1) photo parameter to show_photo.php (2) potd parameter to show_potd.php or (3) the Current question field in a vote action to admin.php.


Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the (1) search (2) \a \ (3) messagesubject and (4) messagebody parameters to certain pages as reachable from manager/index.php; (5) highlight (6) id (7) email (8) name and (9) parent parameters to index.php; and the (10) docgrp and (11) moreResultsPage parameters to index-ajax.php.


Multiple cross-site scripting (XSS) vulnerabilities in Unica Affinium Campaign 7.2.1.0.55 allow remote attackers to inject arbitrary web script or HTML via a Javascript event in the (1) url (2) PageName and (3) title parameters in a CustomBookMarkLink action to Campaign/Campaign; (4) a Javascript event in the displayIcon parameter to Campaign/updateOfferTemplateSubmit.do (aka the templates web page); (5) crafted input to Campaign/CampaignListener (aka the listener server) which is not properly handled when displaying the status log; and (6) id parameter to Campaign/campaignDetails.do (7) id parameter to Campaign/offerDetails.do (8) function parameter to Campaign/Campaign (9) sessionID parameter to Campaign/runAllFlowchart.do (10) id parameter in an edit action to Campaign/updateOfferTemplatePage.do (11) Frame parameter in a LoadFrame action to Campaign/Campaign (12) affiniumUserName parameter to manager/jsp/test.jsp (13) affiniumUserName parameter to Campaign/main.do and possibly other vectors.


Unspecified vulnerability in Adium before 1.2 has unknown impact and attack vectors related to javascript: URLs possibly cross-site scripting (XSS).


Cross-site scripting (XSS) vulnerability in index.php in Nuked-Klan 1.3 beta allows remote attackers to inject arbitrary web script or HTML via the nuked_nude parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Refine by Taxonomy 5.x before 5.x-0.1 a module for Drupal allows remote attackers to inject arbitrary web script or HTML via a taxonomy term which is not properly handled by refine_by_taxo when displaying tags.


Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in ACG-PTP 1.0.6 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) Category name field under Advertisement Packages the (2) Reason field under Credit/Debit Users and the (3) FAQ question and (4) FAQ answer fields under Add New FAQ Entry.


Cross-site scripting (XSS) vulnerability in modules/system/admin.php in XOOPS 2.0.18.1 allows remote attackers to inject arbitrary web script or HTML via the fct parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to inject arbitrary web script or HTML via the (1) lOptionsOptions (2) lNavAdminOptions or (3) lNavReturn parameter to options.php; or the (4) lNavReturn parameter to subscribe.php.


Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3 when \Show New Private Message Notification Pop-Up\ is enabled allows remote authenticated users to inject arbitrary web script or HTML via a private message subject (aka newpmtitle).


Cross-site scripting (XSS) vulnerability in FreeStyle Wiki 3.6.2 and earlier and 3.6.3 dev3 and earlier development versions when Internet Explorer is used allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different issue than CVE-2005-1799.


Cross-site scripting (XSS) vulnerability in index.php in Xomol CMS 1.2 allows remote attackers to inject arbitrary web script or HTML via the current_url parameter in a tellafriend action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Claroline

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

cwd

parameter

in

a

rqMkHtml

action

to

document/rqmkhtml.php

or

the

query

string

to

announcements/announcements.php

calendar/agenda.php

course/index.php

document/document.php

exercise/exercise.php

phpbb/newtopic.php

phpbb/reply.php

phpbb/viewtopic.php

wiki/wiki.php

or

work/work.php

in

claroline/.


Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5.541 allows remote attackers to conduct cross-site scripting (XSS) attacks via an MP3 file with JavaScript in id3 tags.


Cross-site scripting (XSS) vulnerability in the Organic Groups (OG) module 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1 a module for Drupal allows remote authenticated users with group owner permissions to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Image Gallery (Photo Gallery) allow remote attackers to inject arbitrary web script or HTML via the (1) latest parameter to (a) index.php (b) images.php (c) suggest_image.php and (d) image_desc.php; and the (2) msg parameter to index.php images.php and suggest_image.php and (e) index.php (f) adminhome.php (g) config.php (h) changepassword.php (i) cleanup.php (j) browsecats.php and (k) images.php in admin/. NOTE: the image_desc.php/msg vector is covered by CVE-2006-1660. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input which allows remote attackers to conduct cross-site scripting (XSS) attacks as demonstrated by a query string containing a \</\ (less-than slash) sequence.


Cross-site scripting (XSS) vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter in a getpasswd action to register.php.


Multiple cross-site scripting (XSS) vulnerabilities in files generated by Adobe Presenter 6 and 7 before 7.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) viewer.swf and (2) loadflash.js a different vulnerability than CVE-2008-3516.


Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference) (2) HtmlForm.cs (RenderAttributes) (3) HtmlInputButton (RenderAttributes) (4) HtmlInputRadioButton (RenderAttributes) and (5) HtmlSelect (RenderChildren).


Cross-site scripting (XSS) vulnerability in (1) Text_Filter/Filter/xss.php in Horde 3.1.x before 3.1.9 and 3.2.x before 3.2.2 and (2) externalinput.php in Popoon r22196 and earlier allows remote attackers to inject arbitrary web script or HTML by using / (slash) characters as replacements for spaces in an HTML e-mail message.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in dotProject 2.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the inactive parameter in a tasks action (2) the date parameter in a calendar day_view action (3) the callback parameter in a public calendar action or (4) the type parameter in a ticketsmith action.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in IDevSpot PhpLinkExchange 1.01 allow remote attackers to inject arbitrary web script or HTML via the catid parameter in a (1) user_add (2) recip (3) tellafriend or (4) contact action or (5) in a request without an action; or (6) the id parameter in a tellafriend action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTML via (1) the real name field related to the user list; (2) the target parameter to login.php (3) the title parameter to activities/some.php (4) the company_name parameter to companies/some.php (5) the last_name parameter to contacts/some.php (6) the campaign_title parameter to campaigns/some.php (7) the opportunity_title parameter to opportunities/some.php (8) the case_title parameter to cases/some.php (9) the file_id parameter to files/some.php or (10) the starting parameter to reports/custom/mileage.php a related issue to CVE-2008-1129.


Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite 3.20.02 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the sessionid parameter in a livesupport startclientchat action to visitor/index.php; (2) the filter parameter in a news view action to index.php; or the Full Name field in a (3) account creation (4) ticket opening or (5) chat request operation.


Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input which allows remote attackers to conduct cross-site scripting (XSS) attacks as demonstrated by a query string containing a \<~/\ (less-than tilde slash) sequence followed by a crafted STYLE element.


Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab parameter in an index action to the Products module as reachable through index.php; (2) the user_password parameter in an Authenticate action to the Users module as reachable through index.php; or (3) the query_string parameter in a UnifiedSearch action to the Home module as reachable through index.php.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in OpenCart 0.7.7 allow remote attackers to inject arbitrary web script or HTML via the (1) firstname and (2) search parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the (1) query string to (a) announcements/messages.php; (b) lostPassword.php and (c) profile.php in auth/; (d) calendar/myagenda.php; (e) group/group.php; (f) learningPath.php (g) learningPathList.php and (h) module.php in learnPath/; (i) phpbb/index.php; (j) courseLog.php (k) course_access_details.php (l) delete_course_stats.php (m) userLog.php and (n) user_access_details.php in tracking/; (o) user/user.php; and (p) user/userInfo.php; the (2) view parameter to (q) tracking/courseLog.php; and the (3) toolId parameter to (r) tracking/toolaccess_details.php. NOTE: this may overlap CVE-2006-3257 and CVE-2005-1374.


Multiple cross-site scripting (XSS) vulnerabilities in Open Media Collectors Database (OpenDb) 1.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) user_id parameter in an edit action to user_admin.php the (2) title parameter to listings.php and the (3) redirect_url parameter to user_profile.php.


Multiple cross-site scripting (XSS) vulnerabilities in BilboBlog 0.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) content parameter to admin/update.php related to conflicting code in widget.php; and allow remote attackers to inject arbitrary web script or HTML via the (2) titleId parameter to head.php reachable through index.php; the (3) t_langlang_copyright parameter to footer.php; the (4) content parameter to the default URI under admin/; the (5) url (6) t_langlang_admin_help (7) t_langlang_admin_clear_cache (8) t_langlang_admin_home and (9) t_langlang_admin_logout parameters to admin/homelink.php; and the (10) t_langlang_admin_new_post parameter to admin/post.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors possibly involving upload of files containing XSS sequences.


Multiple cross-site scripting (XSS) vulnerabilities in Chipmunk Blog (Blogger) allow remote attackers to inject arbitrary web script or HTML via the membername parameter to (1) members.php (2) comments.php (3) photos.php (4) archive.php or (5) cat.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote attackers to inject arbitrary web script or HTML via the uid parameter to (1) friends.php (2) seutubo.php (3) album.php (4) scrapbook.php (5) index.php or (6) tribes.php; or (7) the description field of a new scrap.


Cross-site scripting (XSS) vulnerability in ZoneO-soft freeForum 1.7 allows remote attackers to inject arbitrary web script or HTML via the acuparam parameter to (1) the default URI or (2) index.php or (3) the PATH_INFO to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in KAPhotoservice allow remote attackers to inject arbitrary web script or HTML via the (1) filename parameter to search.asp and the (2) page parameter to order.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Accept (2) Accept-Language (3) UA-CPU (4) Accept-Encoding (5) User-Agent or (6) Cookie HTTP header. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Web Dynpro (WD) in the SAP NetWeaver portal when Internet Explorer 7.0.5730 is used allows remote attackers to inject arbitrary web script or HTML via a crafted URI which causes the XSS payload to be reflected in a text/plain document.


Multiple cross-site scripting (XSS) vulnerabilities in staticpages/easyecards/index.php in MyioSoft EasyE-Cards 3.5 trial edition (tr) and 3.10a allow remote attackers to inject arbitrary web script or HTML via the (1) ResultHtml (2) dir (3) SenderName (4) RecipientName (5) SenderMail and (6) RecipientMail parameters.


Multiple cross-site scripting (XSS) vulnerabilities in files generated by Adobe Presenter 6 and 7 before 7.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) viewer.swf and (2) loadflash.js a different vulnerability than CVE-2008-3515.


Cross-site scripting (XSS) vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1 1.1.4 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field (aka Label ==> Value pairs). NOTE: some of these details are obtained from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Pluck

when

is

enabled

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

(a)

the

titelkop

and

titelkop

parameters

to

(b)

the

and

titelkop

parameters

to

(c)

and

the

parameter

to

(d)


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Mambo

and

when

is

enabled

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

query

string

to

and

the

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities (1) in the WYSIWYG editors (2) during local group creation (3) during HTML redirects (4) in the HTML import (5) in the Rich text editor and (6) in link-page in IBM Lotus Quickr 8.1 services for Lotus Domino before Hotfix 15 allow remote attackers to inject arbitrary web script or HTML via unknown vectors including (7) the Imported Page. NOTE: the vulnerability in the WYSIWYG editors may exist because of an incomplete fix for CVE-2008-2163.


Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.


The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser which allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading files containing arbitrary web script or HTML.


Cross-site scripting (XSS) vulnerability in Snark VisualPic 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the pic parameter to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via (1) a certain referrer field in usercp2.php (2) a certain location field in inc/functions_online.php and certain (3) tsubject and (4) psubject fields in moderation.php.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in Pagefusion 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) acct_fname and (2) acct_lname parameters in an edit action and the (3) PID (4) PGID and (5) rez parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.10 PL2 and earlier and 3.7.2 and earlier 3.7.x versions allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO (PHP_SELF) or (2) the do parameter as demonstrated by requests to upload/admincp/faq.php. NOTE: this issue can be leveraged to execute arbitrary PHP code.


Unspecified vulnerability in Simple Machines Forum (SMF) 1.1.x before 1.1.5 and 1.0.x before 1.0.13 has unknown impact and attack vectors probably cross-site scripting (XSS) related to \use of the html-tag.\


The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not \prevent use of the object HTML tag in administrator input \ which has unknown impact and attack vectors probably related to an insufficient cross-site scripting (XSS) protection mechanism.


Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to people.php and allow remote authenticated users to inject arbitrary web script or HTML via the (2) Account picture and (3) Icon fields in account.php. NOTE: some of these details are obtained from third party information.


The CQWeb login page in IBM Rational ClearQuest 7.0.1 allows remote attackers to obtain potentially sensitive information (page source code) via a combination of ?script? and ?/script? sequences in the id field possibly related to a cross-site scripting (XSS) vulnerability.


Multiple cross-site scripting (XSS) vulnerabilities in Meeting Room Booking System (MRBS) 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the area parameter to (1) day.php (2) week.php (3) month.php (4) search.php (5) report.php and (6) help.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms which are not properly handled on node preview pages and (2) unspecified OpenID values.


Cross-site scripting (XSS) vulnerability in the XenAPI HTTP interfaces in Citrix XenServer Express Standard and Enterprise Edition 4.1.0; Citrix XenServer Dell Edition (Express and Enterprise) 4.1.0; and HP integrated Citrix XenServer (Select and Enterprise) 4.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the search feature in the Forum plugin before 2.7.1 for Geeklog allows remote attackers to inject arbitrary web script or HTML via unspecified vectors probably related to (1) public_html/index.php (2) config.php and (3) functions.inc.


Cross-site scripting (XSS) vulnerability in the error page feature in Panasonic Network Camera BL-C111 BL-C131 BB-HCM511 BB-HCM531 BB-HCM580 BB-HCM581 BB-HCM527 and BB-HCM515 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5 and Fedora Directory Server allow remote attackers to inject arbitrary web script or HTML via input values that use % (percent) escaping.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

Maian

Recipe

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

header

and

parameters.


Multiple cross-site scripting (XSS) vulnerabilities in Xigla Absolute Form Processor XE 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) showfields (2) text and (3) submissions parameters to search.asp and the (4) name parameter to users.asp. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Phoenix View CMS Pre Alpha2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ltarget parameter to (a) admin/admin_frame.php and the (2) conf parameter to (b) gbuch.admin.php (c) links.admin.php (d) menue.admin.php (e) news.admin.php and (f) todo.admin.php in admin/module/.


Cross-site scripting (XSS) vulnerability in the servlet engine and Web container in the Web Server service in IBM Lotus Domino before 7.0.3 FP1 and 8.x before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.


Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0 Web Dynpro for ABAP (aka WD4A or WDA) and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc/gui/sap/its/webgui/.


Cross-site scripting (XSS) vulnerability in view.php in ActualScripts ActualAnalyzer Server 8.37 and earlier ActualAnalyzer Gold 7.74 and earlier ActualAnalyzer Pro 6.95 and earlier and ActualAnalyzer Lite 2.78 and earlier allows remote attackers to inject arbitrary web script or HTML via the language parameter.


Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers to inject arbitrary web script or HTML via the query string. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in SystemList.jsp in SysAid 5.1.08 allows remote attackers to inject arbitrary web script or HTML via the searchField parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

Glassfish

webadmin

interface

in

Sun

Java

System

Application

Server

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew

propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType

propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass

or

propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc

parameter

to

(a)

resourceNode/customResourceNew.jsf;

the

propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup

or

parameter

to

(b)

resourceNode/externalResourceNew.jsf;

the

propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi

propertyForm:propertySheet:propertSectionTextField:nameProp:name

or

propertyForm:propertySheet:propertSectionTextField:descProp:desc

parameter

to

(c)

resourceNode/jmsDestinationNew.jsf;

the

propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi

or

propertyForm:propertySheet:generalPropertySheet:descProp:cd

parameter

to

(d)

resourceNode/jmsConnectionNew.jsf;

the

propertyForm:propertySheet:propertSectionTextField:jndiProp:jnditext

or

parameter

to

(e)

resourceNode/jdbcResourceNew.jsf;

the

propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name

propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname

or

propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder

parameter

to

(f)

applications/lifecycleModulesNew.jsf;

or

the

propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name

propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType

or

propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db

parameter

to

(g)


Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) bookCopyright and (2) ver parameters to (a) footer.php and the (3) bookName (4) bookMetaTags and (5) estiloCSS parameters to (b) header.php.


Multiple cross-site scripting (XSS) vulnerabilities in Maian Support 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script (2) msg_script2 and (3) msg_script3 parameters to admin/inc/footer.php; and the (4) msg_script2 parameter to admin/inc/header.php.


Cross-site scripting (XSS) vulnerability in the Journal module in Tru-Zone Nuke ET 3.x allows remote attackers to inject arbitrary web script or HTML via the title parameter in a new entry as demonstrated by a CSS property in the STYLE attribute of a DIV element a different vulnerability than CVE-2008-1873.


Multiple cross-site scripting (XSS) vulnerabilities in Xigla Absolute Banner Manager XE 2.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the text parameter in (1) searchbanners.asp and (2) listadvertisers.asp and other unspecified fields. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in bb_admin.php in miniBB 2.2a allows remote attackers to inject arbitrary web script or HTML via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable.


Cross-site scripting (XSS) vulnerability in the Bluemoon Inc. (1) BackPack 0.91 and earlier (2) BmSurvey 0.84 and earlier (3) newbb_fileup 1.83 and earlier (4) News_embed (news_fileup) 1.44 and earlier and (5) PopnupBlog 3.19 and earlier modules for XOOPS 2.0.x XOOPS Cube 2.1 and ImpressCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in template2.php in PEGames allow remote attackers to inject arbitrary web script or HTML via the (1) sitetitle (2) sitenav (3) sitemain and (4) sitealt parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an \obscure method.\ NOTE: the vector is probably in the redirect parameter to the Admin Control Panel (admincp/index.php).


Multiple cross-site scripting (XSS) vulnerabilities in Maian Weblog 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter to admin/index.php in a blogs search action the (2) msg_charset and (3) msg_header9 parameters to admin/inc/header.php and the (4) keywords parameter to index.php in a search action.


Multiple cross-site scripting (XSS) vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the (1) search_text and (2) search_category parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2 0.95 before 0.95.3 and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.


Multiple cross-site scripting (XSS) vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1 and 1.4.2.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) query string to login.php and the (2) glb_sid parameter to hta/htmlarea.js.php and allow remote authenticated users to inject arbitrary web script or HTML via an unspecified field in room.php.


Cross-site scripting (XSS) vulnerability in WGate in SAP Internet Transaction Server (ITS) 6.20 allows remote attackers to inject arbitrary web script or HTML via (1) a \<>\ sequence in the ~service parameter to wgate.dll or (2) Javascript splicing in the query string a different vector than CVE-2006-5114.


Multiple cross-site scripting (XSS) vulnerabilities in 427BB 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to (a) register.php (b) reminder.php and (c) search.php; the (2) uname (3) email and (4) email2 parameters to register.php; the (5) email parameter to reminder.php; and the (6) keywords parameter to search.php.


Multiple cross-site scripting (XSS) vulnerabilities in meBiblio 0.4.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sql parameter to dbadd.inc.php (2) InsertJournal parameter to add_journal_mask.inc.php (3) InsertBibliography parameter to insert_mask.inc.php and (4) LabelYear parameter to search_mask.inc.php.


Multiple cross-site scripting (XSS) vulnerabilities in Xigla Absolute News Manager XE 3.2 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) pblname and (2) text parameters to (a) admin/search.asp (3) name parameter to (b) admin/publishers.asp and other unspecified vectors to (c) anmviewer.asp and (d) editarticleX.asp in admin/. NOTE: some of these details are obtained from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

Maian

Search

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

header

and

parameters.


Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11 before 1.2.9-108.2 on SUSE openSUSE 10.3 before 1.2.9-198.2 on SUSE openSUSE 11.0 and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to \insufficient quoting of parameters.\


Multiple cross-site scripting (XSS) vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topic and (2) button parameters to ansFAQ.asp and the (3) id and (4) txtEmail parameters to login.asp.


Cross-site scripting (XSS) vulnerability in admin/users.asp in Xigla Absolute Control Panel XE 1.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter and other unspecified parameters. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability in the Resource Manager component in Oracle Database 10.1.0.5 10.2.0.4 and 11.1.0.6 and Database Control in Enterprise Manager has unknown impact and remote authenticated attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researcher claims that this is a cross-site scripting (XSS) issue that allows remote attackers to inject arbitrary web script or HTML via the REFRESHCHOICE parameter in multiple web pages.


Multiple cross-site scripting (XSS) vulnerabilities in Maian Cart 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_adminheader (2) msg_adminheader2 (3) msg_adminheader3 (4) msg_adminheader4 and unspecified other parameters to admin/inc/header.php; the (5) msg_script3 and unspecified other parameters to admin/inc/footer.php; and the (6) keywords parameter to index.php in a search action.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

HomePH

Design

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

the

parameter

to

the

parameter

to

the

parameter

to

and

the

parameter

to


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

EditeurScripts

EsContacts

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

msg

parameter

to

login.php

importer.php

contacts.php

groupes.php

and

search.php.


Cross-site scripting (XSS) vulnerability in search_results.php in Vastal I-Tech phpVID 1.1 and 1.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: some of these details are obtained from third party information. NOTE: it was later reported that 1.2.3 is also affected.


Cross-site scripting (XSS) vulnerability in search-results.dot in dotCMS 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Fenriru Sleipnir 2.7.1 Release2 and earlier Portable Sleipnir 2.7.1 Release2 and earlier and Grani 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a history mechanism and favorites search a different vulnerability than CVE-2007-6002.


Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter to upload/admin/index.php in a search action the (2) msg_charset and (3) msg_header9 parameters to admin/inc/header.php and the (4) keywords parameter to index.php in a search action.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

Flex

History

Management

feature

in

Adobe

Flex

SDK

and

Flex

Builder

and

generated

applications

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

anchor

identifier

to

or

in

templates/html-templates/.

NOTE:

Firefox

and

possibly

other

browsers

prevent

exploitation.


Cross-site scripting (XSS) vulnerability in index.php in CyrixMED 1.4 allows remote attackers to inject arbitrary web script or HTML via the msg_erreur parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in (1) dsp_main.php and (2) dsp_task_editor.php in SamTodo 1.1 allow remote attackers to inject arbitrary web script or HTML via the (a) tid parameter in a main.taskeditor edit action and the (b) completed parameter in a main.default action to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in SMEWeb 1.4b and 1.4f allow remote attackers to inject arbitrary web script or HTML via the (1) data parameter to catalog.php the (2) keyword parameter to search.php the (3) page parameter to bb.php and the (4) new_s parameter to order.php.


Multiple cross-site scripting (XSS) vulnerabilities in PHPEasyData 1.5.4 allow remote attackers to inject arbitrary web script or HTML via the (1) annuaire parameter to (a) last_records.php and (b) annuaire.php and the (2) by and (3) cat_id parameters to annuaire.php.


Cross-site scripting (XSS) vulnerability in CGIWrap before 4.1 when an Internet Explorer based browser is used allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to failure to set the charset in error messages.


Cross-site scripting (XSS) vulnerability in index.php in PHP Image Gallery allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Isaac McGowan phpInstantGallery 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) gallery parameter to (a) index.php and (b) image.php and the (2) imgnum parameter to image.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7 when register_globals is enabled and .htaccess support is disabled allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving scripts in libraries/.


Cross-site scripting (XSS) vulnerability in search.asp in DT Centrepiece 4.0 allows remote attackers to inject arbitrary web script or HTML via the searchFor parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Mulatiple cross-site scripting (XSS) vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) toid parameter to send-private-message.asp and the (2) redirect parameter to admin/impersonate.asp. NOTE: vector 2 requires authentication.


Cross-site scripting (XSS) vulnerability in the advanced search mechanism (webapps/search/advanced.jsp) in Sun Java System Web Server 6.1 before SP9 and 7.0 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors probably related to the next parameter.


Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors involving (1) an event handler attached to an outer window (2) a SCRIPT element in an unloaded document or (3) the onreadystatechange handler in conjunction with an XMLHttpRequest.


Multiple cross-site scripting (XSS) vulnerabilities in the delegated spam management feature in the Spam Quarantine Management (SQM) component in MailMarshal SMTP 6.0.3.8 through 6.3.0.0 allow user-assisted remote authenticated users to inject arbitrary web script or HTML via (1) the list of blocked senders or (2) the list of safe senders.


Cross-site scripting (XSS) vulnerability in blosxom.cgi in Blosxom before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the flav parameter (flavour variable). NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Groupware Webmail Edition and Kronolith allow remote attackers to inject arbitrary web script or HTML via the timestamp parameter to (1) week.php (2) workweek.php and (3) day.php; and (4) the horde parameter in the PATH_INFO to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258 and other versions before 5.3.3.378 allows remote attackers to inject arbitrary web script or HTML via a URL-encoded postdata parameter. NOTE: this is different than CVE-2005-1118 but it might be the same as CVE-2008-1470.


Cross-site scripting (XSS) vulnerability in WallCity-Server Shoutcast Admin Panel 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter to the login interface. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in admin/index.php in Script PHP PicEngine 1.0 allows remote attackers to inject arbitrary web script or HTML via the l parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in MainLayout.do in ManageEngine OpUtils 5.0 allows remote attackers to inject arbitrary web script or HTML via the hostName parameter when viewing an SNMP graph. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.


Cross-site scripting (XSS) vulnerability in fe_adminlib.inc in TYPO3 4.0.x before 4.0.9 4.1.x before 4.1.7 and 4.2.x before 4.2.1 as used in extensions such as (1) direct_mail_subscription (2) feuser_admin and (3) kb_md5fepw allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly escape HTML in file:// URLs in directory listings which allows remote attackers to conduct cross-site scripting (XSS) attacks or have unspecified other impact via a crafted filename.


Cross-site scripting (XSS) vulnerability in Caching Proxy (CP) 5.1 through 6.1 in IBM WebSphere Edge Server when CGI mapping rules are enabled allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger injection into an error response.


Cross-site scripting (XSS) vulnerability in files created by Adobe RoboHelp 6 and 7 possibly involving use of a (1) WebHelp5 (WebHelp5Ext) or (2) WildFire (WildFireExt) extension allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2007-1280.


Cross-site scripting (XSS) vulnerability in admin/index.html in Merak IceWarp Mail Server allows remote attackers to inject arbitrary web script or HTML via the message parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in sboxDB.php in Simple Machines Forum (SMF) Shoutbox 1.14 through 1.16b allows remote attackers to inject arbitrary web script or HTML via strings to the shoutbox form that start with \&#\ contain the desired script and end with \;\.


Cross-site scripting (XSS) vulnerability in index.php in Pagetool 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the search_term parameter in a pagetool_search action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) mcsp_opt_msg_no_answer or (2) mcsp_opt_msg_wrong_answer parameter to wp-admin/options-general.php.


Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3 and possibly other versions before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via the dbname parameter. NOTE: this issue only exists until the installation is complete.


Cross-site scripting (XSS) vulnerability in lostsheep.php in Crafty Syntax Live Help (CSLH) before 2.14.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the versions claimed by the original researcher are probably incorrect.


Cross-site scripting (XSS) vulnerability in search.pl in Dansie Search Engine 2.7 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in browse.asp in Schoolwires Academic Portal allows remote attackers to inject arbitrary web script or HTML via the c parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3 7.0 and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp (2) resultsForm parameter to /idm/account/findForSelect.jsp or (3) activeControl parameter to /idm/user/main.jsp.


Cross-site scripting (XSS) vulnerability in Uniwin eCart Professional before 2.0.16 allows remote attackers to inject arbitrary web script or HTML via the rp parameter to cartView.asp and unspecified other components. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

AstroSoft

HelpDesk

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

txtSearch

parameter

to

and

the

parameter

to

NOTE:

for

vector

the

XSS

occurs

in

a

forced

SQL

error

message.


Unspecified vulnerability in Mahara before 0.9.1 has unknown impact and remote attack vectors probably related to cross-site scripting (XSS) in uploaded files.


Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a \framework defined request parameter\ when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.


Mozilla Firefox before 2.0.0.12 Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8 allows remote attackers to execute script outside of the sandbox and conduct cross-site scripting (XSS) attacks via multiple vectors including the XMLDocument.load function aka \JavaScript privilege escalation bugs.\


Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) gbname (2) gbemail (3) gburl and (4) gbmsg parameters to unspecified programs. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 when Internet Explorer 6 is used allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences which are not processed as UTF-8 by Drupal's HTML filtering but are processed as UTF-8 by Internet Explorer effectively removing characters from the document and defeating the HTML protection mechanism.


mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev 2.0.x before 2.0.62-dev and 1.3.x before 1.3.40-dev does not define a charset which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.


Cross-site scripting (XSS) vulnerability in the iMonitor interface in Novell eDirectory 8.7.3.x before 8.7.3 sp10 and 8.8.x before 8.8.2 ftf2 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters that are used within \error messages of the HTTP stack.\


Multiple cross-site scripting (XSS) vulnerabilities in SoftCart.exe in SoftCart 5.1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) License_Plate (2) License_State (3) Ticket_Date and (4) Ticket_Number parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.


Cross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header which is used when composing Forgot Password e-mail messages in HTML format.


Multiple cross-site scripting (XSS) vulnerabilities in templates/example_template.php in AwesomeTemplateEngine allow remote attackers to inject arbitrary web script or HTML via the (1) datatitle (2) datamessage (3) datatable1item (4) datatable1url or (5) datapoweredby parameter.


Cross-site scripting (XSS) vulnerability in photo_album.pl in Dansie Photo Album 1.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the chat client in IBM Lotus Sametime 7.5 and 7.5.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted message which triggers code execution after a mouseover event initiated by the victim.


Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.10b1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) editing templates and (2) the list's \info attribute\ in the web administrator interface a different vulnerability than CVE-2006-3636.


Cross-site scripting (XSS) vulnerability in the log feature in the John Godley Search Unleashed 0.2.10 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter which is not properly handled when the administrator views the log file.


Cross-site scripting (XSS) vulnerability in search.cgi in Loris Hotel Reservation System 3.01 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the hotel_name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to inscription.php (2) courseCode parameter to main/calendar/myagenda.php (3) category parameter to main/admin/course_category.php (4) message parameter to main/admin/session_list.php in a show_message action and (5) an avatar image to main/auth/profile.php.


Cross-site scripting (XSS) vulnerability in mynews.inc.php in MyNews 1.6.4 and other earlier 1.6.x versions allows remote attackers to inject arbitrary web script or HTML via the hash parameter in an admin action to index.php a different vulnerability than CVE-2006-2208.1.


Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediately after the Help argument and possibly unspecified other vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

the

Simon

Elvery

WP-Footnotes

plugin

for

WordPress

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

wp_footnotes_current_settingsstyle_rules

wp_footnotes_current_settingspre_footnotes

and

wp_footnotes_current_settingspost_footnotes

parameters.


Cross-site scripting (XSS) vulnerability in the Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series 5.x-1.2 and earlier in the 5.x-1.x series 4.7.x-2.6 and earlier in the 4.7.x-2.x series and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors that write to summary table pages.


Cross-site scripting (XSS) vulnerability in index.php in MercuryBoard 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter (aka the message text area) which leads to an injection in the messenger during private message (PM) preview. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the (1) showlink parameter to jsp/DiscoveryProfiles.jsp; the (2) attributeIDs (3) attributeToSelect (4) redirectto and (5) resourceid parameters to (a) jsp/ThresholdActionConfiguration.jsp; the (6) page and (7) redirect parameters to (b) jsp/UpdateGlobalSettings.jsp; and the (8) haid and (9) returnpath parameters to (c) showTile.do. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in search.asp in Tendenci CMS allow remote attackers to inject arbitrary web script or HTML via the (1) category (2) searchtext (3) jobcategoryid (4) contactcompany and unspecified other parameters. NOTE: some of these details are obtained from third party information. NOTE: it is not clear whether this affects Tendenci Enterprise Edition in addition to the product's deployment on Tendenci's own server farm. If only the latter was affected then this issue should not be included in CVE.


Cross-site scripting (XSS) vulnerability in search.php in Crux Software CruxCMS 3.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox before 2.0.0.12 Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8 allow remote attackers to inject arbitrary web script or HTML via certain character encodings including (1) a backspace character that is treated as whitespace (2) 0x80 with Shift_JIS encoding and (3) \zero-length non-ASCII sequences\ in certain Asian character sets.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

cryptographp/admin.php

in

the

Cryptographp

and

earlier

plugin

for

WordPress

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

cryptwidth

cryptheight

bgimg

charR

charG

charB

charclear

tfont

charel

charelc

charelv

charnbmin

charnbmax

charspace

charsizemin

charsizemax

charanglemax

noisepxmin

noisepxmax

noiselinemin

noiselinemax

nbcirclemin

nbcirclemax

or

brushsize

parameter

to

wp-admin/options-general.php.


Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1 1.10 through 1.10.2 1.9 through 1.9.4 and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1) the \Real name\ field in Personal Settings which is presented to readers of articles; or (2) a file upload as demonstrated by a .htm .html or .js file.


Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via (1) the view_type parameter to graph.php; (2) the filter parameter to graph_view.php; (3) the action parameter to the draw_navigation_text function in lib/functions.php reachable through index.php (aka the login page) or data_input.php; or (4) the login_username parameter to index.php.


Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series 2.0.61 and earlier in the 2.0.x series and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension which leads to injection within a (1) \406 Not Acceptable\ or (2) \300 Multiple Choices\ HTTP response when the extension is omitted in a request for the file.


Multiple cross-site scripting (XSS) vulnerabilities in PRO-Search 0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) prot (2) host (3) path (4) name (5) ext (6) size (7) search_days or (8) show_page parameter to the default URI.


Multiple cross-site scripting (XSS) vulnerabilities in the Search function in the web management interface in F5 BIG-IP 9.4.3 allow remote attackers to inject arbitrary web script or HTML via the SearchString parameter to (1) list_system.jsp (2) list_pktfilter.jsp (3) list_ltm.jsp (4) resources_audit.jsp and (5) list_asm.jsp in tmui/Control/jspmap/tmui/system/log/; and (6) list.jsp in certain directories.


Cross-site scripting (XSS) vulnerability in search.cgi in Sift Unity allows remote attackers to inject arbitrary web script or HTML via the qt parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML via the search parameter to webmin_search.cgi (aka the search section) and possibly other components accessed through a \search box\ or \open file box.\ NOTE: some of these details are obtained from third party information.


Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism for applications via unspecified vectors related to the setEncoding function.


Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) attributes such as style and onmouseover in (a) forum post or (b) mail; or (2) the website field of the profile.


Multiple cross-site scripting (XSS) vulnerabilities in captcha\\captcha.php in the Captcha! 2.5d and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) captcha_ttffolder (2) captcha_numchars (3) captcha_ttfrange or (4) captcha_secret parameter.


Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter to wp-admin/admin.php or the (2) messagefield parameter in the guestbook page and the (3) title parameter in the messagearea.


Cross-site scripting (XSS) vulnerability in vpnum/userslist.php in Endian Firewall 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the psearch parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Jinzora Media Jukebox 2.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) frontend (2) set_frontend (3) jz_path (4) theme and (5) set_theme parameters to (a) index.php; the frontend theme and (6) language parameters to (b) ajax_request.php; the jz_path parameter to (c) slim.php; the frontend theme and jz_path parameters to (d) popup.php; the (13) PATH_INFO to index.php and (e) slim.php; and the (14) query parameter in a playlistedit action and (15) siteNewsData parameter in a sitenews action to (f) popup.php.


Multiple cross-site scripting (XSS) vulnerabilities in Spyce - Python Server Pages (PSP) 2.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the url or type parameter to docs/examples/redirect.spy; (2) the x parameter to docs/examples/handlervalidate.spy; (3) the name parameter to spyce/examples/request.spy; (4) the Name parameter to spyce/examples/getpost.spy; (5) the mytextarea parameter the mypass parameter or an empty parameter to spyce/examples/formtag.spy; (6) the newline parameter to the default URI under demos/chat/; (7) the text1 parameter to docs/examples/formintro.spy; or (8) the mytext or mydate parameter to docs/examples/formtag.spy.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

wp-contact-form/options-contactform.php

in

the

WP-ContactForm

alpha

and

earlier

plugin

for

WordPress

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

parameter

to

wp-admin/admin.php

or

the

SRC

attribute

of

an

IFRAME

element.


Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Barracuda Spam Firewall (BSF) before 3.5.12.007 Message Archiver before 1.2.1.002 Web Filter before 3.3.0.052 IM Firewall before 3.1.01.017 and Load Balancer before 2.3.024 allow remote attackers to inject arbitrary web script or HTML via (1) the Policy Name field in Search Based Retention Policy in Message Archiver; unspecified parameters in the (2) IP Configuration (3) Administration (4) Journal Accounts (5) Retention Policy and (6) GroupWise Sync components in Message Archiver; (7) input to search operations in Web Filter; and (8) input used in error messages and (9) hidden INPUT elements in (a) Spam Firewall (b) IM Firewall and (c) Web Filter.


Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface in Sophos ES1000 and ES4000 Email Security Appliance 2.1.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) error and (2) go parameters to the login page.


Cross-site scripting (XSS) vulnerability in Tor World Tor Search 1.1 and earlier I-Navigator 4.0 Mobile Frontier 2.1 and earlier Diary.cgi (aka Quotes of the Day) 1.5 and earlier Tor News 1.21 and earlier Simple BBS 1.3 and earlier Interactive BBS 1.3 and earlier Tor Board 1.1 and earlier Simple Vote 1.1 and earlier and Com Vote 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier and possibly 2.1.x through 2.3.x allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.


Cross-site scripting (XSS) vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to inject arbitrary web script or HTML via the msg parameter a different product than CVE-2006-6022. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


** DISPUTED ** Cross-site scripting (XSS) vulnerability in index.php in Etomite 0.6.1.4 Final allows remote attackers to inject arbitrary web script or HTML via $_SERVER'PHP_INFO'. NOTE: the vendor disputes this issue in a followup stating that the affected variable is $_SERVER'PHP_SELF' and \This is not an Etomite specific exploit and I would like the report rescinded.\


Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Academic Suite 7.x and earlier and possibly some 8.0 versions allow remote attackers to inject arbitrary web script or HTML via (1) the searchText parameter in a Course action to webapps/blackboard/execute/viewCatalog or (2) the data__announcements___pk1_pk2__subject parameter in an ADD action to bin/common/announcement.pl.


Multiple cross-site scripting (XSS) vulnerabilities in Flyspray 0.9.9 through 0.9.9.4 allow remote attackers to inject arbitrary web script or HTML via (1) a forced SQL error message or (2) old_value and new_value database fields in task summaries related to the item_summary parameter in a details action in index.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in BosDates 3.x and 4.x allows remote attackers to inject arbitrary web script or HTML via (1) the type parameter in calendar.php and (2) the category parameter in calendar_search.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web script or HTML via the path parameter to (1) popup.php (2) test/dir2.php (3) admin/upload.php and (4) dirxml.php in upload/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the user account creation feature in Exponent CMS 0.96.6-GA20071003 and earlier when the Allow Registration? configuration option is enabled allow remote attackers to inject arbitrary web script or HTML via the (1) username (2) firstname (3) lastname and (4) e-mail address fields. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in redirect.do in Xitex WebContent M1 allows remote attackers to inject arbitrary web script or HTML via the sid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in search.php in Gallarific allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in account.php in BosClassifieds Classified Ads System 3.0 allows remote attackers to inject arbitrary web script or HTML via the returnTo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the tab parameter to (1) index.php as demonstrated using mixed case and encoded whitespace characters in the tag; or (2) clientinfo.php (3) invoices.php (4) smartlinks.php and (5) todo.php as demonstrated using a META tag.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

LinPHA

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

ftp/index.php

viewer.php

functions/other.php

and


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

Centreon

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

name

and

title

parameters.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Multiple cross-site scripting (XSS) vulnerabilities in the Drupal modules (1) Internationalization (i18n) 5.x before 5.x-2.3 and 5.x-1.1 and 6.x before 6.x-1.0 beta 1; and (2) Localizer 5.x before 5.x-3.4 5.x-2.1 and 5.x-1.11; allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter to aspAdmin/deleteUser.asp a different vector than CVE-2008-1174. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Opera before 9.26 allows remote attackers to \bypass sanitization filters\ and conduct cross-site scripting (XSS) attacks via crafted attribute values in an XML document which are not properly handled during DOM presentation.


Cross-site scripting (XSS) vulnerability in WoltLab Community Framework (WCF) 1.0.6 in WoltLab Burning Board 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the (1) page and (2) form parameters which are not properly handled when they are reflected back in an error message.


Multiple cross-site scripting (XSS) vulnerabilities in GeeCarts allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) show.php (2) search.php and (3) view.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the Sitedesigner before 1.1.5 search template in Magnolia Enterprise Edition allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13 Thunderbird before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to inject arbitrary web script or HTML via event handlers aka \Universal XSS using event handlers.\


The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES as used in eGroupWare before 1.4.003 Moodle before 1.8.5 and other products allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.


Multiple cross-site scripting (XSS) vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary web script or HTML via the file parameter to (1) watermark.php and (2) catalog_watermark.php in core/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Digiappz DigiDomain 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) domain parameter to lookup_result.asp and the (2) word1 and (3) word2 parameters to suggest_result.asp.


Cross-site scripting (XSS) vulnerability in index.php in Jeebles Technology Jeebles Directory 2.9.60 allows remote attackers to inject arbitrary web script or HTML via the path parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the management GUI in Imperva SecureSphere MX Management Server 5.0 allows remote attackers to inject arbitrary web script or HTML via an invalid or prohibited request to a web server protected by SecureSphere which triggers injection into the \corrective action\ section of an alert page.


Cross-site scripting (XSS) vulnerability in index.php in Pictures Pro (aka Tim Grissett) Photo Cart 4.1 allows remote attackers to inject arbitrary web script or HTML via the amessage parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Savvy Content Manager (CM) allow remote attackers to inject arbitrary web script or HTML via the searchterms parameter to (1) searchresults.cfm (2) search_results.cfm and (3) search_results/index.cfm. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in mindex.do in ManageEngine Firewall Analyzer 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the displayName parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attackers to inject arbitrary web script or HTML via the var:category parameter as demonstrated by a request for advanced/portforw.htm on the fwan page.


Multiple cross-site scripting (XSS) vulnerabilities in the Administration Console in Sun Java System Access Manager 7.1 and 7 2005Q4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the (1) Help and (2) Version windows.


Multiple cross-site scripting (XSS) vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to inject arbitrary web script or HTML via the (1) UserName parameter to loginproc.asp and the (2) usr parameter to Login.asp.


Cross-site scripting (XSS) vulnerability in search.php in Interspire Shopping Cart 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Squid Analysis Report Generator (Sarg) 2.2.3.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent header which is not properly handled when displaying the Squid proxy log. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

CuteFlow

and

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

language

parameter

to

page/showcirculation.php;

and

showfields.php

showuser.php

and

showtemplates.php

in

pages/.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in Clansphere 2008 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in WebCT Campus Edition 4.1.5.8 when \Don't wrap text\ is enabled allow remote authenticated users to inject arbitrary web script or HTML via a (1) mail message or (2) discussion board message. NOTE: this might overlap CVE-2005-1076.


Cross-site scripting (XSS) vulnerability in index.php in JV2 Folder Gallery 3.1 allows remote attackers to inject arbitrary web script or HTML via the image parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The Drupal.checkPlain function in Drupal 6.0 only escapes the first instance of a character in ECMAScript which allows remote attackers to conduct cross-site scripting (XSS) attacks.


Cross-site scripting (XSS) vulnerability in gallery.php in Simple Gallery 2.2 allows remote attackers to inject arbitrary web script or HTML via the album parameter to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parameter in an invite action to wp-admin/users.php and the (2) to parameter in a sent action to wp-admin/invites.php.


Cross-site scripting (XSS) vulnerability in index.php in cyberfrogs.net cfnetgs 0.24 allows remote attackers to inject arbitrary web script or HTML via the directory parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter a related issue to CVE-2008-1299. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

BolinOS

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

url

parameter

to

(a)

ForEditor

parameter

to

(b)

the

to

(c)

gBLoginPage.php

and

(d)

gBPassword.php

in

formlogin

parameter

to

and

the

parameter

to

(e)

help/index.php.


Cross-site scripting (XSS) vulnerability in bs_auth.php in Blogator-script 0.95 and 1.01 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Crafty Syntax Live Help (CSLH) before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) livehelp.php (2) user_questions.php and (3) leavemessage.php. NOTE: the lostsheep.php vector is covered by CVE-2008-0848.


Cross-site

scripting

(XSS)

vulnerability

in

the

Logfile

Viewer

Settings

function

in

in

Alkacon

OpenCms

and

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

in

a

save

action

a

different

vector

than


Multiple cross-site scripting (XSS) vulnerabilities in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO or (2) the q parameter in an about action to the help system.


The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the \Always Use Secure HTML Editor\ (aka Editor Security or Secure Editing) parameter which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Cezanne

and

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

LookUPId

and

CbFun

parameters

to

(a)

CFLookUP.asp;

TitleParms

WidgetsHeights

WidgetsLinks

and

WidgetsTitles

parameters

to

(b)

CznCommon/CznCustomContainer.asp

CFTARGET

parameter

to

(c)

home.asp

PersonOid

parameter

to

(d)

DESTLINKOID

and

PersonOID

parameters

to

(e)

and

the

FolderTemplateId

and

FolderTemplateName

parameters

to

(f)


Cross-site scripting (XSS) vulnerability in set_permissions.php in Podcast Generator 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the scriptlang parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in index.php in CS-Cart 1.3.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a products search action. NOTE: it was also reported that 1.3.5-SP2 trial edition is also affected.


Cross-site scripting (XSS) vulnerability in the private message feature in Nuke ET 3.2 and 3.4 when using Internet Explorer allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in AMFPHP 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) class parameter to (a) methodTable.php (b) code.php and (c) details.php in browser/; and the (2) location parameter to browser/code.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the file listing function in the web management interface in Packeteer PacketShaper and PolicyCenter 8.2.2 allows remote attackers to inject arbitrary web script or HTML via the FILELIST parameter to an arbitrary component which triggers injection into an Error Report page.


IBM Lotus Quickr 8.0 server and possibly QuickPlace 7.x does not properly identify URIs containing cross-site scripting (XSS) attack strings which allows remote attackers to inject arbitrary web script or HTML via a Calendar OpenDocument action to main.nsf with a Count parameter containing a JavaScript event in a malformed element as demonstrated by an onload event in an IFRAME element.


Cross-site scripting (XSS) vulnerability in index.php in JV2 Quick Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the f parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in searchAction.do in ManageEngine EventLog Analyzer 5 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Fixed in EventLog Analyzer 10.0 Build 10000.


Cross-site scripting (XSS) vulnerability in WebCore as used in Apple Safari before 3.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to sites that set the document.domain property or have the same document.domain.


Incomplete blacklist vulnerability in IISWebAgentIF.dll in the WebID RSA Authentication Agent 5.3 and possibly earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via the postdata parameter due to an incomplete fix for CVE-2005-1118.


Cross-site scripting (XSS) vulnerability in Numara FootPrints for Linux 8.1 allows remote attackers to inject arbitrary web script or HTML via the Title form field when setting an appointment. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in namazu.cgi in Namazu before 2.0.18 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded input related to failure to set the charset a different vector than CVE-2004-1318 and CVE-2001-1350. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the board parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the profile update feature in Akiva WebBoard 8.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in the form field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php (b) notice.php and (c) inset.php in view/sniplets/ and possibly (d) modules/execute.php; the (2) url parameter to (e) view/admin/submenu.php; and the (3) page parameter to (f) view/admin/pager.php.


Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via (1) unspecified path fields or (2) the database host field. NOTE: the timing window for exploitation of this issue might be limited.


The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3 Red Hat Enterprise Linux 5 and other operating systems omits some invalid character sequences during conversion of some character encodings which might allow remote attackers to conduct cross-site scripting (XSS) attacks.


Multgiple cross-site scripting (XSS) vulnerabilities in module/main.php in WORK system e-commerce 4.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) day (2) month and (3) year parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-rc1 module for Drupal allow remote attackers to inject arbitrary web script or HTML via text fields intended for the (1) address and (2) order information which are later displayed on the order view page and unspecified other administrative pages a different vulnerability than CVE-2008-1428.


Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3 4.5.6 and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment possibly involving a (1) .jpg or (2) .gif image attachment.


Multiple cross-site scripting (XSS) vulnerabilities in the search feature in Polymita BPM-Suite and CollagePortal allow remote attackers to inject arbitrary web script or HTML via the (1) _q and (2) lucene_index_field_value parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in view.cgi in Smart Classified ADS Professional Smart Photo ADS and Smart Photo ADS Gold allow remote attackers to inject arbitrary web script or HTML via the (1) AdNum and (2) Department parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in Poplar Gedcom Viewer 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) text and (2) ul parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the Ubercart 5.x before 5.x-1.0 rc3 module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via node titles related to unspecified product features a different vector than CVE-2008-1428.


Cross-site scripting (XSS) vulnerability in setup.php3 in phpHeaven phpMyChat 0.14.5 allows remote attackers to inject arbitrary web script or HTML via the Lang parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37 5.5.0 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.


Cross-site scripting (XSS) vulnerability in cgi-bin/contray/search.cgi in ContRay 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) certain input processed by formatter/text_gedit.py (aka the gui editor formatter); (2) a page name which triggers an injection in PageEditor.py when the page is successfully deleted by a victim in a DeletePage action; or (3) the destination page name for a RenamePage action which triggers an injection in PageEditor.py when a victim's rename attempt fails because of a duplicate name. NOTE: the AttachFile XSS issue is already covered by CVE-2008-0781 and the login XSS issue is already covered by CVE-2008-0780.


Cross-site scripting (XSS) vulnerability in index.php in TinyPortal 0.8.6 and 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in index.php in Maian Cart 1.1 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search command. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in DivXDB 2002 0.94b allow remote attackers to inject arbitrary web script or HTML via the (1) choice (2) _page_ (3) zone_admin (4) general_search and (5) import parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows Mac OS X Linux and Solaris and 10.3.185.22 and earlier on Android allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a \universal cross-site scripting vulnerability.\


Cross-site scripting (XSS) vulnerability in the SIP implementation on the Cisco SPA8000 and SPA8800 before 6.1.11 SPA2102 and SPA3102 before 5.2.13 and SPA 500 series IP phones before 7.4.9 allows remote attackers to inject arbitrary web script or HTML via the FROM field of an INVITE message aka Bug IDs CSCtr27277 CSCtr27256 CSCtr27274 and CSCtr14715.


The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter as demonstrated by an (a) command action or a (b) hosts action.


Cross-site

scripting

(XSS)

vulnerability

in

the

helper

in

in

Ruby

on

Rails

before

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

tag

with

an

invalid

name.


Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7 3.0.x through 3.3.x 3.4.x before 3.4.12 3.5.x 3.6.x before 3.6.6 3.7.x 4.0.x before 4.0.2 and 4.1.x before 4.1.3 when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode allows remote attackers to inject arbitrary web script or HTML via a crafted patch related to content sniffing.


Opera before 11.50 does not properly restrict data: URIs which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.


Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name.


Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI related to improper handling of value attributes in (1) FileHandler.java (2) HiddenHandler.java (3) PasswordHandler.java (4) RadioHandler.java (5) ResetHandler.java (6) SelectHandler.java (7) SubmitHandler.java and (8) TextFieldHandler.java.


Multiple cross-site scripting (XSS) vulnerabilities in Mahara before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) URI attributes and (2) the External Feed component as demonstrated by the guid element in an RSS feed.


Cross-site scripting (XSS) vulnerability in the PageBuilder2 (aka Page Builder) theme in IBM WebSphere Portal 7.x before 7.0.0.1 CF006 as used in IBM Web Content Manager (WCM) and other products allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in Icinga before 1.4.1 when escape_html_tags is disabled allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression as demonstrated by the onload attribute of a BODY element located after a check-host-alive! sequence a different vulnerability than CVE-2011-2179.


Cross-site

scripting

(XSS)

vulnerability

in

in

Ruby

on

Rails

before

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

malformed

Unicode

string

related

to

a

escaping

vulnerability.\


The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12 3.0.x before 3.0.8 and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method as demonstrated by the sub method.


Cross-site scripting (XSS) vulnerability in Novell Identity Manager (aka IDM) User Application 3.5.0 3.5.1 3.6.0 3.6.1 3.7.0 and 4.0.0 and Identity Manager Roles Based Provisioning Module 3.6.0 3.6.1 3.7.0 and 4.0.0 allows remote attackers to inject arbitrary web script or HTML via the apwaDetail (aka apwaDetailId) parameter aka Bug 709603.