Total
42233 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2014-125097 | 1 Bestwebsoft | 1 Facebook Button | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability, which was classified as problematic, was found in BestWebSoft Facebook Like Button up to 2.33. Affected is the function fcbkbttn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.34 is able to address this issue. The patch is identified as b766da8fa100779409a953f0e46c2a2448cbe99c. It is recommended to upgrade the affected component. VDB-225354 is the identifie ...
Show More |
|||||
| CVE-2014-125096 | 1 Fancy Gallery Project | 1 Fancy Gallery | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file class.options.php of the component Options Page. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.13 is able to address this issue. The identifier of the patch is fdf1f9e5a1ec738900f962e69c6fa4ec6055ed8d. It is recommended to upgrade the affected component. Th ...
Show More |
|||||
| CVE-2014-125095 | 1 Bestwebsoft | 1 Contact Form | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. ...
Show More |
|||||
| CVE-2014-125094 | 1 Phpminiadmin Project | 1 Phpminiadmin | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability classified as problematic was found in phpMiniAdmin up to 1.8.120510. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.9.140405 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-225001 was assigned to this vulnerability.
|
|||||
| CVE-2014-125092 | 1 Maxfoundry | 1 Maxbuttons | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability was found in MaxButtons Plugin up to 1.26.0 on WordPress and classified as problematic. This issue affects the function maxbuttons_strip_px of the file includes/maxbuttons-button.php. The manipulation of the argument button_id leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.26.1 is able to address this issue. The patch is named e74564c9e3b7429808e317f4916bd1c26ef0b806. It is recommended to upgrade the affected component. The associated ...
Show More |
|||||
| CVE-2014-125090 | 1 Media Downloader Project | 1 Media Downloader | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects the function dl_file_resumable of the file getfile.php. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.1.993 is able to address this issue. The patch is identified as 77beb720c682b9300035ab5f96eee225181d8a92. It is recommended to upgrade the affected component. VDB-222262 is th ...
Show More |
|||||
| CVE-2014-125089 | 1 Cention-chatserver Project | 1 Cention-chatserver | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability was found in cention-chatserver 3.8.0-rc1. It has been declared as problematic. Affected by this vulnerability is the function _formatBody of the file lib/InternalChatProtocol.fe. The manipulation of the argument body leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.9 is able to address this issue. The identifier of the patch is c4c0258bbd18f6915f97f91d5fee625384096a26. It is recommended to upgrade the affected component. The identifier V ...
Show More |
|||||
| CVE-2014-125088 | 1 Qt-users | 1 Silk | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability was found in qt-users-jp silk 0.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file contents/root/examples/header.qml. The manipulation of the argument model.key/model.value leads to cross site scripting. The attack can be initiated remotely. The name of the patch is bbc5d6eeea800025ef29edda3fd3c57836239eae. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221488.
|
|||||
| CVE-2014-125078 | 1 Horizon Project | 1 Horizon | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability was found in yanheven console and classified as problematic. Affected by this issue is some unknown functionality of the file horizon/static/horizon/js/horizon.instances.js. The manipulation leads to cross site scripting. The attack may be launched remotely. The patch is identified as 32a7b713468161282f2ea01d5e2faff980d924cd. It is recommended to apply a patch to fix this issue. VDB-218354 is the identifier assigned to this vulnerability.
|
|||||
| CVE-2014-125070 | 1 Console Project | 1 Console | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability has been found in yanheven console and classified as problematic. Affected by this vulnerability is the function get_zone_hosts/AvailabilityZonesTable of the file openstack_dashboard/dashboards/admin/aggregates/tables.py. The manipulation leads to cross site scripting. The attack can be launched remotely. The patch is named ba908ae88d5925f4f6783eb234cc4ea95017472b. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217651.
|
|||||
| CVE-2014-125039 | 1 Neoxplora Project | 1 Neoxplora | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability, which was classified as problematic, has been found in kkokko NeoXplora. Affected by this issue is some unknown functionality of the component Trainer Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is dce1aecd6ee050a29f953ffd8f02f21c7c13f1e6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217352.
|
|||||
| CVE-2014-125035 | 1 Jobs-plugin Project | 1 Jobs-plugin | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability classified as problematic was found in Jobs-Plugin. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The identifier of the patch is b8a56718b1d42834c6ec51d9c489c5dc20471d7b. It is recommended to apply a patch to fix this issue. The identifier VDB-217189 was assigned to this vulnerability.
|
|||||
| CVE-2014-125034 | 1 Contact App Project | 1 Contact App | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability has been found in stiiv contact_app and classified as problematic. Affected by this vulnerability is the function render of the file libs/View.php. The manipulation of the argument var leads to cross site scripting. The attack can be launched remotely. The patch is named 67bec33f559da9d41a1b45eb9e992bd8683a7f8c. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217183.
|
|||||
| CVE-2014-125031 | 1 Teknet Project | 1 Teknet | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability was found in kirill2485 TekNet. It has been classified as problematic. Affected is an unknown function of the file pages/loggedin.php. The manipulation of the argument statusentery leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 1c575340539f983333aa43fc58ecd76eb53e1816. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217176.
|
|||||
| CVE-2014-125027 | 1 Tbdev Project | 1 Tbdev | 2024-11-21 | 4.0 MEDIUM | 3.5 LOW |
|
A vulnerability has been found in Yuna Scatari TBDev up to 2.1.17 and classified as problematic. Affected by this vulnerability is the function get_user_icons of the file usersearch.php. The manipulation of the argument n/r/r2/em/ip/co/ma/d/d2/ul/ul2/ls/ls2/dl/dl2 leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.1.18 is able to address this issue. The patch is named 0ba3fd4be29dd48fa4455c236a9403b3149a4fd4. It is recommended to upgrade the affected compo ...
Show More |
|||||
| CVE-2014-10398 | 1 Bssys | 1 Rbs Bs-client. Retail Client | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client. Private Client (aka RBS BS-Client. Retail Client) 2.5, 2.4, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) DICTIONARY, (2) FILTERIDENT, (3) FROMSCHEME, (4) FromPoint, or (5) FName_0 parameter and a valid sid parameter value.
|
|||||
| CVE-2014-10395 | 1 Codepeople | 1 Polls Cp | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
|
|||||
| CVE-2014-10393 | 1 Cformsii Project | 1 Cformsii | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The cforms2 plugin before 10.5 for WordPress has XSS.
|
|||||
| CVE-2014-10392 | 1 Cformsii Project | 1 Cformsii | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The cforms2 plugin before 10.2 for WordPress has XSS.
|
|||||
| CVE-2014-10385 | 1 Memphis Documents Library Project | 1 Memphis Documents Library | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
|
|||||
| CVE-2014-10380 | 1 Cozmoslabs | 1 Profile Builder | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
|
|||||
| CVE-2014-10378 | 1 Duplicate Post Project | 1 Duplicate Post | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The duplicate-post plugin before 2.6 for WordPress has XSS.
|
|||||
| CVE-2014-10377 | 1 Cformsii Project | 1 Cformsii | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
|
|||||
| CVE-2014-10078 | 1 Vembu | 1 Storegrid | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfailure.php, interface/registerclient/onlineregfailure.php, and interface/registercustomer/onlineregfailure.php.
|
|||||
| CVE-2014-10065 | 1 Remarkable Project | 1 Remarkable | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.
|
|||||
| CVE-2014-0883 | 1 Ibm | 1 Power Hardware Management Console | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
IBM Power HMC 7.1.0 through 7.8.0 and 7.3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 91163.
|
|||||
| CVE-2014-0183 | 1 Redhat | 1 Subscription Asset Manager | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.
|
|||||
| CVE-2014-0014 | 1 Emberjs | 1 Ember.js | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application using the "{{group}}" Helper and a crafted payload.
|
|||||
| CVE-2014-0013 | 1 Emberjs | 1 Ember.js | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value and also contain the `{{this}}` special Handlebars variable.
|
|||||
| CVE-2013-7486 | 1 Open-xchange | 1 Open-xchange Appsuite | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject arbitrary web script or HTML via the body of an email. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects different sets of versions.
|
|||||
| CVE-2013-7485 | 1 Open-xchange | 1 Open-xchange Appsuite | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attackers to inject arbitrary web script or HTML via the publication name, which is not properly handled in an error message. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects different sets of versions.
|
|||||
| CVE-2013-7482 | 1 Reflex Gallery Project | 1 Reflex Gallery | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
|
|||||
| CVE-2013-7481 | 1 Bestwebsoft | 1 Contact Form | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
|
|||||
| CVE-2013-7480 | 1 Pixelite | 1 Events Manager | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
|
|||||
| CVE-2013-7479 | 1 Pixelite | 1 Events Manager | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
|
|||||
| CVE-2013-7478 | 1 Pixelite | 1 Events Manager | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
|
|||||
| CVE-2013-7477 | 1 Pixelite | 1 Events Manager | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
|
|||||
| CVE-2013-7475 | 1 Bestwebsoft | 1 Contact Form | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
|
|||||
| CVE-2013-7474 | 1 Windu | 1 Windu Cms | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users.
|
|||||
| CVE-2013-7472 | 1 Count Per Day Project | 1 Count Per Day | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
|
|||||