Cross-site scripting (XSS) vulnerability in modules/out.php in Pyrophobia 2.1.3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in admin/classes/ui.dta.php in Drake CMS allows remote attackers to inject arbitrary web script or HTML via the desctitle field. NOTE: Drake CMS has only a beta version available and the vendor has previously stated \We do not consider security reports valid until the first official release of Drake CMS.\


Cross-site scripting (XSS) vulnerability in auth.php in Pineapple Technologies QuizShock 1.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via encoded special characters in the forward_to parameter as demonstrated using \<"<\.


Multiple cross-site scripting (XSS) vulnerabilities in (1) PreSearch.html and (2) PreSearch.class in Cisco Secure Access Control Server (ACS) VPN Client Unified Personal Communicator MeetingPlace Unified MeetingPlace Unified MeetingPlace Express CallManager IP Communicator Unified Video Advantage Unified Videoconferencing 35xx products Unified Videoconferencing Manager WAN Manager Security Device Manager Network Analysis Module (NAM) CiscoWorks and related products Wireless LAN Solution Engine (WLSE) 2006 Wireless LAN Controllers (WLC) and Wireless Control System (WCS) allow remote attackers to inject arbitrary web script or HTML via the text field of the search form.


Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.


Cross-site scripting (XSS) vulnerability in the Nullsoft ShoutcastServer 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the top-level URI on the Incoming interface (port 8001/tcp) which is not properly handled in the administrator interface when viewing the log file.


Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase </SCRIPT> end tag which bypasses the protection against lowercase </script>.


Multiple cross-site scripting (XSS) vulnerabilities in WebAPP before 20070214 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to unspecified fields in user Profiles. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) database name (2) table name (3) ViewName (4) view (5) trigger and (6) function fields in main.php and certain other files.


Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6 4.1.0 through 4.1.36 5.0.0 through 5.0.30 5.5.0 through 5.5.23 and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.


Cross-site scripting (XSS) vulnerability in servlet/Spy in Dynamic Monitoring Services (DMS) in Oracle Application Server (OAS) 10g 10.1.2.0.0 allows remote attackers to inject arbitrary web script or HTML via the table parameter. NOTE: This may be related to CVE-2002-0563.


Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite - ESupport 3.00.13 and 3.04.10 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a (1) lostpassword or (2) register action in index.php (3) unspecified vectors in the Submit form in a submit action in index.php and (4) the user's name in index.php; and (5) allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the Admin and Staff Control Panel. NOTE: this might issue overlap CVE-2004-1412 CVE-2005-0487 or CVE-2005-0842.


Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names which are not properly handled when WordPress generates a new link to verify the request.


Cross-site scripting (XSS) vulnerability in SimpleBoxes/SerendipityNZ Serene Bach 2.05R and earlier and 2.08D and earlier in the 2.08 series; and (2) sb 1.13D and earlier and 1.18R and earlier in the 1.18 series; allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in Jupiter CMS 1.1.5 allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header and certain other HTTP headers which are displayed without proper sanitization when an administrator performs a Logged Guest action.


Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the URL (PATH_INFO) to (1) articles/edit.php (2) articles/list.php (3) blogs/list_blogs.php or (4) blogs/rankings.php.


Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Access Manager 6.1 6.2 6 2005Q1 (6.3) and 7 2005Q4 (7.0) before 20070129 allow remote attackers to inject arbitrary web script or HTML via the (1) goto or (2) gx-charset parameter. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in error.php in TaskFreak! 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the tznMessage parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the Attachment Manager (admincp/attachment.php) in Jelsoft vBulletin 3.6.4 allows remote attackers to inject arbitrary web script or HTML via the Extension field. NOTE: this might be a duplicate of CVE-2007-0830.5. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier when Microsoft Internet Explorer 6 is used allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a CSS style in the convcharset parameter to the top-level URI a different vulnerability than CVE-2005-0992.


Cross-site scripting (XSS) vulnerability in Openads 2.0.x before 2.0.10 2.3 before 2.3.31 (aka Max Media Manager before 0.3.31-alpha-pr2) and phpAdsNew/phpPgAds before 2.0.9-pr1 allows remote attackers to inject arbitrary web script or HTML via (1) the keyword parameter in admin-search.php and (2) affiliate-search.php. NOTE: this issue may overlap CVE-2007-0363.


Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net Virtual Calendar allow remote attackers to inject arbitrary web script or HTML via the (1) t and (2) yr parameters and the (3) sho parameter when the m parameter is outside the intended range.


Cross-site scripting (XSS) vulnerability in Nuked Klan 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a getURL statement in a .swf file as demonstrated by \Remote Cookie Disclosure.\ NOTE: it could be argued that this is an issue in Shockwave instead of Nuked Klan.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

nicecoder.com

INDEXU

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

(a)

the

u

parameter

to

(b)

the

and

id

parameters

to

(c)

the

email

name

and

subject

parameters

to

(d)

sendmail.php;

the

email

and

username

parameters

to

(e)

the

keyword

parameter

to

(f)

search.php;

the

username

password

and

email

parameters

to

(g)

register.php;

the

url

and

email

parameters

to

(h)

the

path

and

total

parameters

to

(i)

new.php;

the

query

parameter

to

(j)

modify.php;

the

parameter

to

(k)

login.php;

the

and

email

parameters

to

(l)

the

gateway

parameter

to

(m)

upgrade.php;

and

another

unspecified

vector.


Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) hitcounts and (2) general parameters different vectors than CVE-2007-0857. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) login.asp; and allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters to (2) badword.asp (3) polls.asp and (4) users.asp.


browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2 and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows which allows remote attackers to conduct cross-site scripting (XSS) attacks by opening a blocked popup originating from a javascript: URI in combination with multiple frames having the same data: URI.


** DISPUTED ** Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the vendor disputes this vulnerability stating that \The characters are escaped properly.\


The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2 and SeaMonkey before 1.0.8 inherit the default charset from the parent window which allows remote attackers to conduct cross-site scripting (XSS) attacks as demonstrated using the UTF-7 character set.


Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.009 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this is probably a different vulnerability than CVE-2006-5830.


The KDE HTML library (kdelibs) as used by Konqueror 3.5.5 does not properly parse HTML comments which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag a related issue to CVE-2007-0478.


Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the (1) First Name (2) Last Name and (3) Nickname fields. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving HTML redirection queries aka \Cross-site Scripting and Spoofing Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11 and 4.7 before 4.7.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in the (1) filter and (2) system modules. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability in Oracle Database 9.0.1.5 9.2.0.8 10.1.0.5 and 10.2.0.3 has unknown impact and attack vectors related to XMLDB aka DB06. NOTE: as of 20070123 Oracle has not disputed claims by a reliable researcher that DB06 is for multiple cross-site scripting (XSS) vulnerabilities.


Multiple cross-site scripting (XSS) vulnerabilities in Enthusiast 3.1 allow remote attackers to inject arbitrary web script or HTML via the URI for (1) show_owned.php or (2) show_joined.php. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3 and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts spoof content or obtain sensitive information via certain UTF-encoded script-based e-mail attachments involving an \incorrectly handled UTF character set label\.


Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) ashop/catalogue.php and (b) ashop/basket.php the (2) exp parameter to ashop/catalogue.php the (3) searchstring parameter to (c) ashop/search.php the (4) checkout and (5) action parameters to (d) ashop/shipping.php the cat parameter to (f) cart-path/admin/editcatalogue.php and the (7) resultpage parameter to (g) cart-path/admin/salesadmin.php.


Cross-site scripting (XSS) vulnerability in Movable Type (MT) before 3.34 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the MTCommentPreviewIsStatic tag which can open the \comment entry screen \ a different vulnerability than CVE-2007-0231.


WebCore on Apple Mac OS X 10.3.9 and 10.4.10 as used in Safari does not properly parse HTML comments in TITLE elements which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within an HTML comment.


Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue (3) midblue (4) wtopblue and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321 (6) h311 (7) h312 and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an <FP_DO_NOT_TOUCH> element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550.


Multiple cross-site scripting (XSS) vulnerabilities in Fix and Chips CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in (a) delete-announce.php; the (2) Announcement form field in (b) staff.php; the (3) Client Name (4) Business Name (5) Street (6) Address 2 (7) Town/City (8) Postcode (9) Phone Number (10) Email Address and (11) Website Address form fields in (c) new_customer.php; and unspecified fields in (d) search.php and (e) client-results.php.


Cross-site scripting (XSS) vulnerability in the AJAX module in MediaWiki before 1.6.9 1.7 before 1.7.2 1.8 before 1.8.3 and 1.9 before 1.9.0rc2 when wgUseAjax is enabled allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in index.inc.php in PHProxy before 0.5 beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) datarealm and (2) _url parameters different vectors than CVE-2004-2604. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the sample Cache' Server Page (CSP) scripts in InterSystems Cache' allow remote attackers to inject arbitrary web script or HTML via (1) the TO parameter to loop.csp (2) the VALUE parameter to cookie.csp and (3) the PAGE parameter to showsource.csp in csp/samples/; and allow remote authenticated users to inject arbitrary web script or HTML via (4) the ERROR parameter to csp/samples/xmlclasseserror.csp and unspecified vectors in (5) object.csp and (6) lotteryhistory.csp in csp/samples/.


Multiple cross-site scripting (XSS) vulnerabilities in Ezboxx Portal System Beta 0.7.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pic parameter to custom/piczoom.asp (2) the nocatname parameter to boxx/user-upload.asp or (3) the iid parameter to indexes/newscomments.asp.


Cross-site scripting (XSS) vulnerability in index.html (aka the administration page) in PHP Link Directory (phpLD) 3.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted link which is triggered when the administrator uses the \Validate Links\ functionality.


Cross-site scripting (XSS) vulnerability in admin-search.php in (1) Openads for PostgreSQL (aka phpPgAds) before 2.0.10 and (2) Openads (aka phpAdsNew) before 2.0.10 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.


Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities such as conduct (a) remote file inclusion attacks via the srcdir parameter in custom/import_xml.php or (b) cross-site scripting (XSS) attacks via the rootdir parameter in interface/login/login_frame.php via vectors associated with extract operations on the (1) POST and (2) GET superglobal arrays. NOTE: this issue was originally disputed before the extract behavior was identified in post-disclosure analysis. Also the original report identified \Open Conference Systems \ but this was an error.


Cross-site scripting (XSS) vulnerability in index.php in (1) Fastilo 2.0 and (2) Open Solution Quick.Cart 2.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Professional before 2.37 allow remote attackers to inject arbitrary Javascript script via (1) e-mail messages and (2) the ID parameter to (a) right.asp (b) Forms/MAI/list.asp and (c) Forms/VCF/list.asp in mewebmail/base/default/lang/EN/.


Cross-site scripting (XSS) vulnerability in Oracle Reports Web Cartridge (RWCGI60) in the Workflow Cartridge component as used in Oracle Database 9.2.0.8 10.1.0.5 and 10.2.0.3; Application Server 9.0.4.3 10.1.2.0.2 and 10.1.2.2; Collaboration Suite 10.1.2; and Oracle E-Business Suite and Applications 11.5.10CU2; allows remote authenticated users to inject arbitrary HTML or web script via the genuser parameter to rwcgi60 aka OWF01.


Multiple cross-site scripting (XSS) vulnerabilities in HTTP Commander 6.0 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the (1) LogoffMessage parameter to logofflast.aspx or the (2) txtUsername parameter to Default.aspx. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in images_archive.asp in Uapplication Uphotogallery 1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the s parameter. NOTE: the thumbnails.asp vector is already covered by CVE-2006-3023.


Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10 and (2) Sage++ extensions for Firefox allows remote attackers to inject arbitrary web script or HTML via a \<SCRIPT/=''SRC='\ sequence in an RSS feed a different vulnerability than CVE-2006-4712.


Cross-site scripting (XSS) vulnerability in FlashChat 4.7.8 allows remote attackers to inject arbitrary web script or HTML via the user name field when the user joins a chat room a different vulnerability than CVE-2007-0807. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the (1) Project issue tracking 4.7.0 through 5.x before 20070123 and (2) Project 4.6.0 through 5.x before 20070123 modules for Drupal allow remote authenticated users to inject arbitrary web script or HTML via (a) certain \fields on project nodes\ or (b) \certain project-specific settings regarding issue tracking.\


Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0 and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4 8.x before 8.1.7 and 9.x before 9.2 for Mozilla Firefox Microsoft Internet Explorer 6 SP1 Google Chrome Opera 8.5.4 build 770 and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF (2) XML and (3) XFDF AJAX parameters or (4) an arbitrarily named name=URI anchor identifier aka \Universal XSS (UXSS).\


Cross-site scripting (XSS) vulnerability in /search in iPlanet Web Server 4.x allows remote attackers to inject arbitrary web script or HTML via the NS-max-records parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in Operation/User.pm in Plain Black WebGUI before 7.3.5 (beta) allows remote attackers to inject arbitrary web script or HTML via the username parameter during anonymous registration a different vector than CVE-2007-0308. NOTE: it is possible that a separate \WikiPage titles\ issue was also fixed.


Multiple cross-site scripting (XSS) vulnerabilities in Symantec Web Security (SWS) before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) error messages and (2) blocked page messages produced by SWS.


** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in the Admin Control Panel (AdminCP) in Jelsoft vBulletin 3.6.4 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors related to the (1) User Group Manager (2) User Rank Manager (3) User Title Manager (4) BB Code Manager (5) Attachment Manager (6) Calendar Manager and (7) Forums & Moderators functions. NOTE: the vendor disputes this issue stating that modifying HTML is an intended privilege of an administrator. NOTE: it is possible that this issue overlaps CVE-2006-6040.


Cross-site scripting (XSS) vulnerability in nidp/idff/sso in Novell Access Manager Identity Server before 3.0.0-1013 allows remote attackers to inject arbitrary web script or HTML via the IssueInstant parameter which is not properly handled in the resulting error message.


Cross-site scripting (XSS) vulnerability in DevTrack 6.x allows remote attackers to inject arbitrary web script or HTML via the \Keyword search\ form field and unspecified other form fields that populate a public saved query. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web script or HTML via the domainname parameter in a save action. NOTE: this issue was SPLIT from CVE-2014-9021 per ADT1 due to different affected products and codebases.


Multiple cross-site scripting (XSS) vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to inject arbitrary web script or HTML via the (1) PROFILENAME parameter in a Save action to httpd/cgi-bin/pppsetup.cgi or (2) COMMENT parameter in an Add action to httpd/cgi-bin/ddns.cgi.


CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting (XSS) attacks or obtain sensitive information via multiple unspecified parameters.


Cross-site scripting (XSS) vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to inject arbitrary web script or HTML by importing a link with an unspecified protocol. NOTE: this can be leveraged by remote attackers using CVE-2014-9041.


Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YII_CSRF_TOKEN HTTP cookie or the StudentDocument StudentCategories StudentPreviousDatas parameters to index.php.


Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) index value of an array parameter or the filename parameter in the Content-Disposition header to the (2) file or (3) profile image upload functionality.


Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) datefilter parameter in the access_log page to wp-admin/users.php or (2) simple_security_ip_blacklist parameter in an add_blacklist_ip action in the ip_blacklist page to wp-admin/users.php.


Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 allow remote attackers to inject arbitrary web script or HTML via the sort_by parameter to the (1) opac parameter in opac-search.pl or (2) intranet parameter in catalogue/search.pl.


Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information.


Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5 3.8.x before 3.8.5 and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field as demonstrated by a comment or a post.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

gName

parameter

in

or

parameter

in


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

WebsiteBaker

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

to

or

parameter

to

or

in

wb/modules/.


The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.


Cross-site scripting (XSS) vulnerability in the Rules Link module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the \administer rules links\ permission to inject arbitrary web script or HTML via unspecified vectors which are not properly handled in the (1) question and (2) description strings in a confirmation form for a triggering Rules link.


Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the (1) tr69cAcsURL (2) tr69cAcsUser (3) tr69cAcsPwd (4) tr69cConnReqPwd or (5) tr69cDebugEnable parameter to the TR-069 client page (tr69cfg.cgi); the (6) timezone parameter to the Time and date page (sntpcfg.sntp); or the (7) hostname parameter in a save action to the Quick Stats page (psilan.cgi). NOTE: this issue was SPLIT from CVE-2014-9020 per ADT1 due to different affected products and codebases.


Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the \Manually enter your UA code\ (manual_ua_code_field) field in the General Settings.


Cross-site scripting (XSS) vulnerability in components/filemanager/dialog.php in Codiad 2.4.3 allows remote attackers to inject arbitrary web script or HTML via the short_name parameter in a rename action. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information.


Multiple cross-site scripting (XSS) vulnerabilities in Altitude uAgent in Altitude uCI (Unified Customer Interaction) 7.5 allow remote attackers to inject arbitrary web script or HTML via (1) an email hyperlink or the (2) style parameter in the image attribute section.


Cross-site scripting (XSS) vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content Webform: Edit own content or Webform: Edit any content permission to inject arbitrary web script or HTML via a node title.


Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) type parameter to report.php (2) signature parameter in a do_editsig action to usercp.php or (3) title parameter in the style-templates module in an edit_template action or (4) file parameter in the config-languages module in an edit action to admin/index.php.


Multiple cross-site scripting (XSS) vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) QUERYSTRING variable in lib/TWiki.pm or (2) QUERYPARAMSTRING variable in lib/TWiki/UI/View.pm as demonstrated by the QUERY_STRING to do/view/Main/TWikiPreferences.


Cross-site scripting (XSS) vulnerability in the path-based meta tag editing form in the Meta tags quick module 7.x-2.x before 7.x-2.8 for Drupal allows remote authenticated users with the \Edit path based meta tags\ permission to inject arbitrary web script or HTML via vectors related to deleting a Path-based Metatag.


Multiple cross-site scripting (XSS) vulnerabilities in the Investigative Reports in Websense TRITON AP-WEB before 8.0.0 and Web Security and Filter Web Security Gateway and Web Security Gateway Anywhere 7.8.3 before Hotfix 02 and 7.8.4 before Hotfix 01 allow remote attackers to inject arbitrary web script or HTML via the (1) ReportName (Job Name) parameter to the Explorer report scheduler (cgi-bin/WsCgiExplorerSchedule.exe) in the Job Queue or the col parameter to the (2) Names or (3) Anonymous (explorer_wse/explorer_anon.exe) summary report page.


Multiple cross-site scripting (XSS) vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) account username a (2) node title or a (3) team entity title.


SQL

injection

vulnerability

in

the

actionIndex

function

in

in

HumHub

and

earlier

allows

remote

authenticated

users

to

execute

arbitrary

SQL

commands

via

the

from

parameter

to

index.php.

NOTE:

this

can

be

leveraged

for

cross-site

scripting

(XSS)

attacks

via

a

request

that

causes

an

error.


lib/setup.php in Moodle through 2.4.11 2.5.x before 2.5.9 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not provide charset information in HTTP headers which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts.


The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.


Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function.


Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5 possibly before 2014-07-23 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the videoadssearchQuery parameter to (1) videoads/videoads.php (2) video/video.php or (3) playlist/playlist.php.


Multiple cross-site scripting (XSS) vulnerabilities in cms/front_content.php in Contenido before 4.9.6 when advanced mod rewrite (AMR) is disabled allow remote attackers to inject arbitrary web script or HTML via the (1) idart (2) lang or (3) idcat parameter.


Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki when $wgRawHTML is set to true allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page.


Cross-site scripting (XSS) vulnerability in the tree view (pl_tree.php) feature in Application Security Manager (ASM) in F5 BIG-IP 11.3.0 allows remote attackers to inject arbitrary web script or HTML by accessing a crafted URL during automatic policy generation.


Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.


Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5 3.8.x before 3.8.5 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.


SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks by creating a file that generates an error. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information.


Multiple cross-site scripting (XSS) vulnerabilities in Bilboplanet 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) tribe_name or (2) tags parameter in a tribes page request to user/ or the (3) user_id or (4) fullname parameter to signup.php.


Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholic_add_location action to wp-admin/admin-ajax.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Netsweeper

before

before

and

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

server

parameter

to

customctid

parameter

to

urllist

parameter

to

to

or

to


Multiple cross-site scripting (XSS) vulnerabilities in the Hierarchical Select module 6.x-3.x before 6.x-3.9 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to the (1) taxonomy term title for instances with Save term lineage enabled or (2) entity type fields.


Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to roma/jsp/debug/debug.jsp or (2) an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc a different issue than CVE-2014-5216.


Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension related to inline attachments as demonstrated by a .swf.jpeg filename.


Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) unspecified vectors related to purchase_limit or the (2) name (3) intl (4) nocod or (5) time parameter in an add_delivery_method action to wp-admin/admin-ajax.php.


Multiple cross-site scripting (XSS) vulnerabilities in Stark CRM 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name (2) last_name or (3) notes parameter to the client page; (4) insu_name or (5) price parameter to the add_insurance_cat page; or (6) status parameter to the add_status page.


Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client. Private Client (aka RBS BS-Client. Retail Client) 2.5 2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) DICTIONARY (2) FILTERIDENT (3) FROMSCHEME (4) FromPoint or (5) FName_0 parameter and a valid sid parameter value.


Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the (1) sEcho parameter to comments_paginate.php or (2) stores_paginate.php or the (3) affiliate_url (4) description (5) domain (6) seodescription (7) seoheading (8) seotitle (9) seokeywords (10) settinglogo (11) settingperpage or (12) settingsitename to admin/index.php.


Cross-site scripting (XSS) vulnerability in the easy_social_admin_summary function in the Easy Social module 7.x-2.x before 7.x-2.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a block title.


Cross-site

scripting

(XSS)

vulnerability

in

the

Contact

Form

Clean

and

Simple

(clean-and-simple-contact-form-by-meg-nicholas)

plugin

and

earlier

for

WordPress

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

cscfname

parameter

to

contact-us/.


Multiple cross-site scripting (XSS) vulnerabilities in (1) mainpage.jsp and (2) GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x 3.3.2 before 3.3.2.3 and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fb_login_button parameter in a newfb_update_options action.


Cross-site scripting (XSS) vulnerability in the Blog Portlet in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0.0 through 7.0.0.2 CF29 8.0.0 through 8.0.0.1 CF14 and 8.5.0 before CF04 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename.


Multiple cross-site scripting (XSS) vulnerabilities in JExperts Channel Platform 5.0.33_CCB allow remote attackers to inject arbitrary web script or HTML via the (1) usuario.nome variable in an editarUsuario action to usuario.do or (2) titulo.form variable in a novoChamado action to ticket.do.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

OpenMRS

Standalone

Edition

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

givenName

familyName

or

parameter

to

registrationapp/registerPatient.page;

the

comment

parameter

to

allergyui/allergy.page;

the

parameter

to

the

HTTP

Referer

Header

to

login.htm;

the

returnUrl

parameter

to

or

coreapps/mergeVisits.page;

or

the

visitId

parameter

to


Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1 11.0 before FP7 and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2014-8898 and CVE-2014-8899.


Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7 6.2.1 before 6.2.1.1 IF5 7.0 before FP4 and 7.1 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2015-0144.


Cross-site

scripting

(XSS)

vulnerability

in

in

the

VideoWhisper

Webcam

plugins

for

Drupal

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

URL

to

a

crafted

SVG

file

in

the

feed

parameter.


Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the \Label text\ field to the results configuration page.


Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf) (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf) (3) dojox/av/resources/audio.swf and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit as used in IBM Social Media Analytics 1.3 before IF11 and other products allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter in an addComment action to ajax/profile_functions.php (2) compose_text parameter in a sendMail action to ajax/mail_functions.php (3) comment parameter in an add_comment action to ajax/lounge_functions.php or (4) name parameter in a create_album action to ajax/gallery_functions.php.


Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager 8.0 through 8.0.1.3 8.5.0 through 8.5.0.1 and 8.5.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2014-8914.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database (2) table or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.


Cross-site scripting (XSS) vulnerability in the Print (aka Printer e-mail and PDF versions) module 6.x-1.x before 6.x-1.19 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to nodes.


Cross-site scripting (XSS) vulnerability in the context administration sub-panel in the Site Banner module before 7.x-4.1 for Drupal allows remote authenticated users with the \Administer contexts\ Context UI module permission to inject arbitrary web script or HTML via vectors related to context settings.


Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA Developer Edition Revision 70 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) epm/admin/DataGen.xsjs or (2) epm/services/multiply.xsjs in the democontent.


Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) dataContacttitle parameter to admin/contacts/contacts/add page; (2) dataBlocktitle or (3) dataBlockalias parameter to admin/blocks/blocks/edit page; (4) dataRegiontitle parameter to admin/blocks/regions/add page; (5) dataMenutitle or (6) dataMenualias parameter to admin/menus/menus/add page; or (7) dataLinktitle parameter to admin/menus/links/add/menu page.


Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6 2.2.x before 2.2.3 patch 9 and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO the (2) src parameter in a none action to index.php or the (3) \First Name\ or (4) \Last Name\ field to users/edituser.


Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20 7.x-3.x before 7.x-3.20 and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title when two fields have the same form_key.


Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9 5.0.x before 5.0.8 5.1.x before 5.1.5 and 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via the release parameter to module/releasecontrol.


Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress when debug mode is enabled allows remote attackers to inject arbitrary web script or HTML via the \Cache key\ in the HTML-Comments as demonstrated by the PATH_INFO to the default URI.


Cross-site scripting (XSS) vulnerability in RefinedWiki Original Theme 3.x before 3.5.13 and 4.x before 4.0.12 for Confluence allows remote authenticated users with permissions to create or edit content to inject arbitrary web script or HTML via the versionComment parameter to pages/doeditpage.action.


Cross-site scripting (XSS) vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x-1.4 for Drupal allows remote authenticated users with the \administer themes\ permission to inject arbitrary web script or HTML via vectors related to theme settings.


Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1 11.0 before FP7 and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2014-8897 and CVE-2014-8899.


Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via a crafted config option a different vulnerability than CVE-2014-8987.


Multiple cross-site scripting (XSS) vulnerabilities in mobiquo/smartbanner/welcome.php in the Tapatalk (com.tapatalk.wbb4) plugin 1.x before 1.1.2 for Woltlab Burning Board 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) app_android_id or (2) app_kindle_url parameter.


Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the \manage PIFR environments\ permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page.


Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL aka Bug IDs CSCur19651 CSCur18555 CSCur19630 and CSCur19661.


Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27 6.1.5.x through 6.1.5.3 CF27 7.0.0.x through 7.0.0.2 CF29 8.0.0.x before 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the TableField module 7.x-2.x before 7.x-2.3 allows remote authenticated users with the \administer content types\ or \administer taxonomy\ permission to inject arbitrary web script or HTML via vectors related to the field help text in an entity edit form.


Cross-site scripting (XSS) vulnerability in the Professional theme 7.x before 7.x-2.04 for Drupal allows remote authenticated users with the \administer themes\ permission to inject arbitrary web script or HTML via vectors related to custom copyright information.


Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier and Cisco HostScan Engine 3.1(.05183) and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL aka Bug IDs CSCup82990 and CSCuq80149.


Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) site_name (2) message or (3) site_url parameter.


Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4 2014.1 before 2014.1.2 and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address a different vulnerability than CVE-2014-3475.


Multiple cross-site scripting (XSS) vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the (1) Webform or (2) User sub-modules.


Cross-site scripting (XSS) vulnerability in the NewsFlash theme 6.x-1.x before 6.x-1.7 and 7.x-1.x before 7.x-2.5 for Drupal allows remote authenticated users with the \administer themes\ permission to inject arbitrary web script or HTML via vectors related to font family CSS property.


Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev40 7.6.0 before 7.6.0-rev32 and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type.


Multiple cross-site scripting (XSS) vulnerabilities in Xornic Contact Us allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) email parameter to contact.php or (3) PATH_INFO to setup.php related to the \PHP_SELF\ variable.


Multiple cross-site scripting (XSS) vulnerabilities in skins/default/outline.tpl in C97net Cart Engine before 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) path parameter in the \drop down TOP menu (with path)\ section or (2) print_this_page variable in the footer_content_block section as demonstrated by the QUERY_STRING to (a) index.php (b) checkout.php (c) contact.php (d) detail.php (e) distro.php (f) newsletter.php (g) page.php (h) profile.php (i) search.php (j) sitemap.php (k) task.php or (l) tell.php.


Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the \administer taxonomy\ permission to inject arbitrary web script or HTML via a taxonomy vocabulary label.


Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1 11.0 before FP7 and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2014-8897 and CVE-2014-8898.


Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager 8.0 through 8.0.1.3 8.5.0 through 8.5.0.1 and 8.5.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2014-8913.


Cross-site scripting (XSS) vulnerability in the \set configuration\ box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter a different vulnerability than CVE-2014-8986.


Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier kwebkitpart 1.3.4 and earlier and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip (2) trash (3) tar (4) thumbnail (5) smtps (6) smtp (7) smb (8) remote (9) recentdocuments (10) nntps (11) nntp (12) network (13) mbox (14) ldaps (15) ldap (16) fonts (17) file (18) desktop (19) cgi (20) bookmarks or (21) ar scheme which is not properly handled in an error message.


Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5 4.1.x before 4.1.14.6 and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page.


Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2014-2334 and CVE-2014-2335.


Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email involving 'the aria \tags\ for screenreaders at the top bar'.


Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 10.0S25 10.4 before 10.4R10 11.4 before 11.4R11 12.1 before 12.1R9 12.1X44 before 12.1X44-D30 12.1X45 before 12.1X45-D20 12.1X46 before 12.1X46-D10 and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to index.php.


includes/upload/UploadBase.php in MediaWiki before 1.19.12 1.20.x and 1.21.x before 1.21.6 and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.


Cross-site

scripting

(XSS)

vulnerability

in

in

CMS

Made

Simple

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

action

parameter

a

different

issue

than

NOTE:

the

original

disclosure

also

reported

issues

that

may

not

cross

privilege

boundaries.


Cross-site scripting (XSS) vulnerability in Advanced_Wireless_Content.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the current_page parameter to apply.cgi.


Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression (2) newListList:ExcludeFilesystems or (3) newListList:ExcludeMountPaths parameter to exclusion/configure or (4) text:EmailServer or (5) newListList:Email parameter to notification/configure.


Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8 Thunderbird ESR 17.x through 17.0.10 and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element a related issue to CVE-2013-6674.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

BarracudaDrive

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

sForumName

or

sDescription

parameter

to

sHint

sWord

or

nId

parameter

to

user

parameter

to

name

or

email

parameter

to

feedback.lsp;

lname

or

url

parameter

to

cmd

parameter

to

fs;

newname

description

firstname

lastname

or

id

parameter

to

or

to

fs/.


Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11 2.4.x before 2.4.9 2.5.x before 2.5.5 and 2.6.x before 2.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a quiz question.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

POSH

(aka

Posh

portal

or

Portaneo)

through

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

error

parameter

to

or

id

parameter

to

portal/openrssarticle.php


Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3 6.1.X EE and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName (2) _2_lastName or (3) _2_middleName parameter.


Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request as demonstrated using the client name.


Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page.


Cross-site scripting (XSS) vulnerability in the wrap_html function in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openid_error parameter to MyID.config.php when the openid.mode parameter is set to error which is not properly handled in an error message.


Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4.


Incomplete blacklist vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string as demonstrated by bypassing a protection mechanism that removes only the \alert\ string.


Multiple cross-site scripting (XSS) vulnerabilities in the Transform Content Center in Bottomline Technologies Transform Foundation Server before 4.3.1 Patch 8 and 5.x before 5.2 Patch 7 allow remote attackers to inject arbitrary web script or HTML via the (1) pn parameter to index.fsp/document.pdf (2) db or (3) referer parameter to index.fsp/index.fsp or (4) PATH_INFO to the default URI.


Multiple cross-site scripting (XSS) vulnerabilities in the Business Voice Services Manager (BVSM) page in Cisco Unified Communications Domain Manager 9.0(.1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters aka Bug IDs CSCum78536 CSCum78526 CSCum69809 and CSCum63113.


Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the (1) state parameter to objects/who/index.htm or (2) User email address to quarantine/spam/manage.htm.


Cross-site

scripting

(XSS)

vulnerability

in

in

ATutor

allows

remote

authenticated

administrators

to

inject

arbitrary

web

script

or

HTML

via

the

title

parameter

in

an

action.

NOTE:

the

original

disclosure

also

reported

issues

that

may

not

cross

privilege

boundaries.


Cross-site scripting (XSS) vulnerability in the Rendezvous Daemon (rvd) Rendezvous Routing Daemon (rvrd) Rendezvous Secure Daemon (rvsd) and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2 Messaging Appliance before 8.7.1 and Substation ES before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in dashboard-related HTML documents in Cisco Prime Security Manager (aka PRSM) 9.2(.1-2) and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters aka Bug ID CSCun50687.


Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\\templates\\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the (1) module or (2) message parameter to index.php.


Cross-site scripting (XSS) vulnerability in the Pulse Collaboration (Secure Meeting) user pages in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18 7.3 before 7.3r10 7.4 before 7.4r8 and 8.0 before 8.0r1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attackers to inject arbitrary web script or HTML via the username when (1) logging in or (2) creating an account in the old interface (3) username when creating an account in the new interface (4) hostname in the old interface (5) inspect parameter in the config module (6) commands parameter in the atcommands tool or (7) host parameter in the ping tool.


Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment.


Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier 4.7.x before 4.7.11 and 4.8.x before 4.8.4 and Enterprise Edition 4.6.8 and earlier 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php.


Cross-site

scripting

(XSS)

vulnerability

in

J-Web

in

Juniper

Junos

before

before

(BBE)

before

before

before

before

before

before

before

before

and

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to inject arbitrary web script or HTML via the (1) agent string for a check_mk agent a (2) crafted request to a monitored host which is not properly handled by the logwatch module or other unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck (2) callback_radio and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters as demonstrated by the title of an uploaded file.


Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.


Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.


Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) thanks_caption (2) thanks_caption_style or (3) thanks_style parameter to wp-admin/options.php.


Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject arbitrary web script or HTML via the category0 parameter which is not properly handled when displaying the Subjects tab in the View Properties menu option.


Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12 1.20.x and 1.21.x before 1.21.6 and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.


Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11 2.4.x before 2.4.11 2.5.x before 2.5.7 2.6.x before 2.6.4 and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.


The addto parameter to fup in Frams' Fast File EXchange (F*EX aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks


Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4 2014.1 before 2014.1.2 and Juno before Juno-2 when used with Heat allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.


Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6 as downloaded before 20140424 or IP.Nexus 1.5.x through 1.5.9 as downloaded before 20140424 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

Mayan

EDMS

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

a

tag

or

the

title

of

a

source

in

a

Staging

folder

Name

field

in

a

bootstrap

setup

or

Title

field

in

a

smart

link

or

web

form.


Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4 2014.1 before 2014.1.2 and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.


Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Prime Security Manager (aka PRSM) 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via a (1) Access Policies or (2) Device Summary Dashboard parameter aka Bug ID CSCuq80661.


Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.2 6.3 before 6.3.0.6 7.0 before 7.0.0.6 7.5 before 7.5.0.5 and 8.0 before 8.0.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted (1) error or (2) success message for a scheduled task.


Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images NextGEN Manage gallery or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the \Alt & Title Text\ field.


Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11 2.4.x before 2.4.11 2.5.x before 2.5.7 2.6.x before 2.6.4 and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX exception dialog.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8 6.x and 7.1 through 7.1.1.2 and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8 7.1 through 7.1.1.2 and 7.2 for Tivoli Asset Management for IT and certain other products allow remote authenticated users to inject arbitrary web script or HTML via unspecified input to a .jsp file under webclient/utility/.


Multiple cross-site scripting (XSS) vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web script or HTML via the group parameter which is not properly handled in a (1) hid_cat or (2) open_folder form element or (3) id parameter which is not properly handled in the open_id form element.


Cross-site scripting (XSS) vulnerability in admin/picture_modify.php in the photo-edit subsystem in Piwigo 2.6.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the associate field a different vulnerability than CVE-2014-4649.


Multiple cross-site scripting (XSS) vulnerabilities in Cisco Prime Security Manager (PRSM) 9.2(.1-2) and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the (1) Dashboard or (2) Configure Realm page aka Bug ID CSCuo94808.


Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39 1.7.54 and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.


Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11 2.4.x before 2.4.11 2.5.x before 2.5.7 2.6.x before 2.6.4 and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.


Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16 1.21.x before 1.21.10 and 1.22.x before 1.22.7 when wgRawHtml is enabled allows remote attackers to inject arbitrary web script or HTML via an invalid username.


Multiple cross-site scripting (XSS) vulnerabilities in the (1) Gallery and (2) core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors possibly related to the print_unescaped function.


Multiple cross-site scripting (XSS) vulnerabilities in the web client interface in Ipswitch IMail Server 12.3 and 12.4 possibly before 12.4.1.15 allow remote attackers to inject arbitrary web script or HTML via (1) the Name field in an add new contact action in the Contacts section or unspecified vectors in (2) an Add Group task in the Contacts section (3) an add new event action in the Calendar section or (4) the Task section.


Cross-site

scripting

(XSS)

vulnerability

in

the

function

in

in

Moodle

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

crafted

username

that

is

improperly

handled

during

the

logging

of

an

invalid

login

attempt.


Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the (1) edit or (2) add action in the user-users module or the (3) finduser action or the name parameter in an (4) edit action in the user-user module or the (5) editprofile action to modcp.php.


Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34 4.7.0 before 4.7.19 6.0.0 before 6.0.14 6.1.0 before 6.1.9 and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via unknown parameters.


Cross-site scripting (XSS) vulnerability in the web-based device management interface in Palo Alto Networks PAN-OS before 5.0.15 5.1.x before 5.1.10 and 6.0.x before 6.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka Ref ID 64563.


Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters aka Bug IDs CSCuq31129 CSCuq31134 CSCuq31137 and CSCuq31563.


Cross-site scripting (XSS) vulnerability in templates/defaultheader.php in Lamp Design Storesprite before 7 - 19-06-14 when using the currency selection dropdown allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to brand.php related to the currencyUrl function.


Cross-site scripting (XSS) vulnerability in the Contact Bank plugin before 2.0.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Label field related to form layout configuration. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10 10.0.0.x before 10.0.0.1 iFix 10 10.0.1.x before 10.0.1.4 and 10.0.2.x before 10.0.2.2 iFix 2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page related to create update and destroy notification boxes.


Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to kvm.cgi or (2) the key parameter to avctalert.php.


Cross-site scripting (XSS) vulnerability in the layout wizard in the Grid Elements (gridelements) extension before 1.5.1 and 2.0.x before 2.0.3 for TYPO3 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Dolibarr

ERP/CRM

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

mainmenu

or

leftmenu

parameter

to

index.php;

the

or

parameter

to

user/index.php;

the

or

parameter

to

user/logout.php;

the

email

firstname

job

lastname

or

login

parameter

in

an

update

action

in

a

\User

Card\

to

user/fiche.php;

or

the

modulepart

or

file

parameter

to

viewimage.php.


Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Printer Model field to the Printer Management page (2) Image Name field to the Image Management page (3) Storage Group Name field to the Storage Management page (4) Username field to the User Cleanup FOG Configuration page or (5) Directory Path field to the Directory Cleaner FOG Configuration page.


Multiple cross-site scripting (XSS) vulnerabilities in the login page in the administrative web interface in Cisco TelePresence Server Software 4.0(2.8) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter aka Bug ID CSCup90060.


Cross-site scripting (XSS) vulnerability in I-O DATA DEVICE RockDisk with firmware before 1.05e1-2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. NOTE: This vulnerability exists because of an incomplete fix for CVE-2013-4713.


Cross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter aka Bug ID CSCup76308.


Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM AFM Analytics APM ASM GTM and Link Controller 11.2.1 through 11.5.1 AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1 PSM 11.2.1 through 11.4.1 WebAccelerator and WOM 11.2.1 through 11.3.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.


Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.


Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the logoLink parameter to (1) preview.swf (2) preview_skin_rouge.swf (3) preview_allchars.swf or (4) preview_skin_overlay.swf in deploy/.


Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/tag_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote attackers to inject arbitrary web script or HTML via the (1) find (2) lib or (3) sid parameter.


Cross-site scripting (XSS) vulnerability in SRX Web Authentication (webauth) in Juniper Junos 11.4 before 11.4R11 12.1X44 before 12.1X44-D34 12.1X45 before 12.1X45-D25 12.1X46 before 12.1X46-D20 and 12.1X47 before 12.1X47-D10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site

scripting

(XSS)

vulnerability

in

in

the

Launch

Instance

menu

in

OpenStack

Dashboard

(Horizon)

before

before

and

Juno

before

allows

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

a

network

name.


Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp (2) name parameter to user.lsp (3) path parameter to wizard/setuser.lsp (4) host parameter to tunnelconstr.lsp or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/.


Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters aka Bug ID CSCup92550.


Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Customer Voice Portal (CVP) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter aka Bug IDs CSCuh61711 CSCuh61720 CSCuh61723 CSCuh61726 CSCuh61727 CSCuh61731 and CSCuh61733.


Cross-site scripting (XSS) vulnerability in the web server in the Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 8.0 before 8.0r6 7.4 before 7.4r13 and 7.1 before 7.1r20 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

vBulletin

Alpha

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

to

privatemessage/new/

the

folderid

parameter

to

a

private

message

in

privatemessage/view

a

fragment

indicator

to

/help

or

the

view

parameter

to

a

topic

as

demonstrated

by

a

request

to

forum/anunturi-importante/rst-power/67030-rst-admin-restore.


Cross-site scripting (XSS) vulnerability in IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3 10.0.0.x before 10.0.0.1 10.0.1.x before 10.0.1.3 and 10.0.2.x before 10.0.2.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 7.1 before 7.1r16 7.4 before 7.4r3 and 8.0 before 8.0r1 and the Juniper Junos Pulse Access Control Service devices with UAC OS 4.1 before 4.1r8 4.4 before 4.4r3 and 5.0 before 5.0r1 allows remote administrators to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do (2) channels/software/Entitlements.do or (3) admin/multiorg/OrgUsers.do.


Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4 2014.1 before 2014.1.2 and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address a different vulnerability than CVE-2014-8578.


Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance (ESA) 8.0 Web Security Appliance (WSA) 8.0 (.5 Hot Patch 1) and earlier and Content Security Management Appliance (SMA) 8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted parameter as demonstrated by the date_range parameter to monitor/reports/overview on the IronPort ESA aka Bug IDs CSCun07998 CSCun07844 and CSCun07888.


Multiple cross-site scripting (XSS) vulnerabilities in the contact module (admin/modules/contact.php) in Pixie CMS 1.04 allow remote attackers to inject arbitrary web script or HTML via the (1) uemail or (2) subject parameter in the Contact form to contact/.


Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input.


Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django as used in Review Board allows remote attackers to inject arbitrary web script or HTML via a JSON object as demonstrated by the name field when changing a user name.


Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in includes/delete_img.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.


Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003 YCK003 and YCW003; S range YCB004 YCK004 YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002 YCK002 and YCW003; and Y-cam Original Range YCB001 YCW001 running firmware 4.30 and earlier allow remote authenticated users to inject arbitrary web script or HTML via the (1) SYSCONTACT parameter to form/identityApply as triggered using en/identity.asp; (2) PASSWD parameter to form/accAdd as triggered using en/account/accedit.asp; (3) NTPSERVER parameter to form/clockApply as triggered using en/clock.asp; (4) SERVER parameter to form/smtpclientApply as triggered using en/smtpclient.asp; (5) SERVER parameter to form/ftpApply as triggered using en/ftp.asp; or (6) SERVER parameter to form/httpEventApply as triggered using en/httpevent.asp.


The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart.


Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink as used in Google Chrome before 35.0.1916.114 allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content aka \Universal XSS (UXSS).\


Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php (4) htmlchat.php (5) video.php or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.


Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error.


Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone (2) Street (3) Address line (4) Zip code or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php.


Cross-site scripting (XSS) vulnerability in controlpanel/loading.aspx in Telligent Evolution before 6.1.19.36103 7.x before 7.1.12.36162 7.5.x and 7.6.x before 7.6.7.36651 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user (3) email or (4) name parameter in a Save Settings action to admin/settings.php.


Cross-site

scripting

(XSS)

vulnerability

in

brightmail/setting/compliance/DlpConnectFlow$view.flo

in

the

management

console

in

Symantec

Messaging

Gateway

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

displayTab

parameter.


** DISPUTED ** Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Team; it may be site-specific. If so then this CVE will be REJECTed in the future.


Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka \SQL Master Data Services XSS Vulnerability.\


Bugzilla 2.x through 4.0.x before 4.0.15 4.1.x and 4.2.x before 4.2.11 4.3.x and 4.4.x before 4.4.6 and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.


The docshell implementation in Mozilla Firefox before 29.0 Firefox ESR 24.x before 24.5 Thunderbird before 24.5 and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property and conduct cross-site scripting (XSS) attacks via a crafted web site that performs history navigation.


Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0 7.00 through 7.02 and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP.


Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to inject arbitrary web script or HTML via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.


Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1 SharePoint Foundation 2013 Gold and SP1 Office Web Apps Server 2013 Gold and SP1 and SharePoint Server 2013 Client Components SDK allows remote attackers to inject arbitrary web script or HTML via a crafted request aka \SharePoint XSS Vulnerability.\


Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action which is not properly handled in a forced SQL error message.


Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2 as maintained by Jon Rohan and James M. Greene allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).


Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the href parameter to page/place.html. NOTE: this was originally reported as a cross-site scripting (XSS) vulnerability but this may be inaccurate.


Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889.


Cross-site scripting (XSS) vulnerability in the Runtime_SetPrototype function in runtime.cc in Google V8 as used in Google Chrome before 34.0.1847.116 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka \Universal XSS (UXSS).\


Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.


Incomplete blacklist vulnerability in the user registration feature in rexx Recruitment R6.1 and R7 without \fixes from 2014-01-15\ allows remote attackers to conduct cross-site scripting (XSS) attacks via the oninput event handler in the fname parameter to the default URI in /reg.


Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the (1) topic parameter to sw/add_topic.php or (2) nick parameter to sw/chat/message.php.


Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID aka \Lync Server Content Sanitization Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns (2) dhcp (3) nat (4) route or (5) lan in network/; or (6) wifi/config.


Cross-site scripting (XSS) vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37 8.0 before MP1 FP2 and 8.5 before MP1 IF26 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.


Cross-site scripting (XSS) vulnerability in the back-office case-management application in RSA Adaptive Authentication (On-Premise) 6.x and 7.x before 7.1 SP0 P2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Power Hardware Management Console (HMC) 7R7.1.0 7R7.2.0 7R7.3.0 through 7R7.3.5 7R7.7.0 through SP3 and 7R7.8.0 before SP1 allows remote attackers to inject arbitrary web script or HTML via the user name on the logon screen. IBM X-Force ID: 91163.


Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI.


Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL a different vulnerability than CVE-2014-0942.


Cross-site scripting (XSS) vulnerability in openreport.jsp in IBM Maximo Asset Management 7.x before 7.1.1.12 IFIX.20140321-1336 and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT Tivoli Service Request Manager Maximo Service Desk and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.12 IFIX.20140218-1510 allows remote authenticated users to inject arbitrary web script or HTML via a crafted report parameter.


Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL for an MHTML document.


Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL aka Bug ID CSCum46470.


Cross-site scripting (XSS) vulnerability in customreport.jsp in IBM Maximo Asset Management 7.5.x before 7.5.0.5 IFIX006 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.


Multiple cross-site scripting (XSS) vulnerabilities in the (1) ForwardController and (2) AttributeEditor scripts in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux Adobe AIR before 14.0.0.110 Adobe AIR SDK before 14.0.0.110 and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2014-0532 and CVE-2014-0533.


Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php (2) the htmlblob parameter to admin/addhtmlblob.php the (3) title or (4) url parameter to admin/addbookmark.php (5) the stylesheet_name parameter to admin/copystylesheet.php (6) the template_name parameter to admin/copytemplate.php the (7) title or (8) url parameter to admin/editbookmark.php (9) the template parameter to admin/listtemplates.php or (10) the css_name parameter to admin/listcss.php a different issue than CVE-2014-2092.


Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages aka Bug ID CSCui15064.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

Apache

OFBiz

before

and

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors

which

are

not

properly

handled

in

a

result

or

error

message.


Ember.js 1.0.x before 1.0.1 1.1.x before 1.1.3 1.2.x before 1.2.1 1.3.x before 1.3.1 and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value and also contain the `{{this}}` special Handlebars variable.


Cross-site scripting (XSS) vulnerability in the WCM (Web Content Manager) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27 6.1.5.x through 6.1.5.3 CF27 7.0.0.x through 7.0.0.2 CF27 and 8.0.0.x before 8.0.0.1 CF11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability on Google Search Appliance (GSA) devices before 7.0.14.G.216 and 7.2 before 7.2.0.G.114 when dynamic navigation is configured allows remote attackers to inject arbitrary web script or HTML via input included in a SCRIPT element.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

web

client

in

Serena

Dimensions

CM

build

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

framecmd

identifier

merant.adm.adapters.AdmDialogPropertyMgr

id

or

type

parameter

to

the

dimensions/

URI.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

Ruby

on

Rails

before

before

and

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

format

or

units

parameter

to

the

(a)

(b)

or

(c)

helper.


Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux Adobe AIR before 13.0.0.83 on Android Adobe AIR SDK before 13.0.0.83 and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in IBM Eclipse Help System (IEHS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0 through 7.0.0.2 CF27 and 8.0 before 8.0.0.1 CF06 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.