Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-10059 State: PUBLISHED Published: 2025-08-13T20:33:50.619Z Last Updated: 2025-11-20T22:43:38.183Z Vendors: Dolibarr Project Products: ERP/CRM Problem Types: CWE-78 Description: Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dolibarr_cmd_exec.
s: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dolibarr_cmd_exec.rb - https://www.exploit-db.com/exploits/18725 - https://www.exploit-db.com/exploits/18724 - https://seclists.org/fulldisclosure/2012/Apr/78 - https://www.dolibarr.org/ - https://www.vulncheck.com/advisories/dolibarr-erp-crm-post-auth-os-command-injection
CVE ID: CVE-2012-10060 State: PUBLISHED Published: 2025-08-13T20:53:55.845Z Last Updated: 2025-11-20T22:49:04.920Z Vendors: Sysax Software Products: Multi Server Problem Types: CWE-121 Description: Sysax Multi Server versions prior to 5.55 contains a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sy
ment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sysax_ssh_username.rb - https://www.exploit-db.com/exploits/18535 - https://www.exploit-db.com/exploits/18557 - https://web.archive.org/web/20120302203344/http://www.pwnag3.com/2012/02/sysax-multi-server-ssh-username-exploit.html - https://advisories.checkpoint.com/defense/advisories/public/2012/cpai-23-sepc.html - https://www.sysax.com/ - https://www.vulncheck.com/advisories/sysax-multi-server-ssh-username-buffer-overflow
CVE ID: CVE-2012-10061 State: PUBLISHED Published: 2025-08-20T15:39:57.651Z Last Updated: 2025-11-22T13:56:05.315Z Vendors: Sockso Project Products: Music Host Server Problem Types: CWE-22 Description: Sockso Music Host Server versions <= 1.5 are vulnerable to a path traversal flaw that allows unauthenticated remote attackers to read arbitrary files from the server’s filesystem. The vulnerability exists in the HTTP interface on port 4444, where the endpoint /file/ fails to properly sanitize user-supplied input. Attackers can traverse directories and access sensitive files outside the intended web root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://web.archive.org/w
utside the intended web root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://web.archive.org/web/20120326095835/http://sockso.pu-gh.com/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/sockso_traversal.rb - https://github.com/rodnaph/sockso - http://aluigi.altervista.org/adv/sockso_1-adv.txt - https://www.exploit-db.com/exploits/18605 - https://www.vulncheck.com/advisories/sockso-music-host-server-path-traversal
CVE ID: CVE-2012-10062 State: PUBLISHED Published: 2025-08-30T13:57:30.250Z Last Updated: 2025-11-20T22:53:12.502Z Vendors: Apache Friends Products: XAMPP Problem Types: CWE-434, CWE-306 Description: A vulnerability in XAMPP, developed by Apache Friends, version 1.7.3's default WebDAV configuration allows remote authenticated attackers to upload and execute arbitrary PHP code. The WebDAV service, accessible via /webdav/, accepts HTTP PUT requests using default credentials. This permits attackers to upload a malicious PHP payload and trigger its execution via a subsequent GET request, resulting in remote code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
T request, resulting in remote code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/xampp_webdav_upload_php.rb - https://www.exploit-db.com/exploits/18367 - https://www.apachefriends.org/index.html - https://www.vulncheck.com/advisories/xampp-webdav-php-upload-auth-bypass-rce
CVE ID: CVE-2012-10063 State: PUBLISHED Published: 2025-10-30T21:31:21.797Z Last Updated: 2025-11-24T20:28:50.030Z Vendors: Nagios Products: XI Problem Types: CWE-89 Description: Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
e cases, impact the application database more broadly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-in-legacy-ccm
CVE ID: CVE-2012-1000 State: PUBLISHED Published: 2012-02-20T19:00:00Z Last Updated: 2024-09-17T00:02:22.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admins/login/forgot/index.php, or the (2) display_name or (3) email parameter to account/preferences.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt - http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php - https://www.htbridge.ch/adviso
ngelog_1.1.4.txt - http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php - https://www.htbridge.ch/advisory/HTB23072
CVE ID: CVE-2012-1001 State: PUBLISHED Published: 2019-11-21T21:54:40 Last Updated: 2024-08-06T18:45:26.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.ch/advisory/HTB23073 - http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html - http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/ - https://github.com/vito/chyrp/commit
12-02/0121.html - http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/ - https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c - http://www.securityfocus.com/bid/52115 - http://www.securityfocus.com/bid/52117
CVE ID: CVE-2012-1002 State: PUBLISHED Published: 2012-02-08T02:00:00 Last Updated: 2024-08-06T18:45:26.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary SQL commands via the pid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75399 - http://www.securityfocus.com/bid/51927 - http://www.openconf.com/news/#20120202 - http://www.exploit-db.com/exploits/18820
CVE ID: CVE-2012-1003 State: PUBLISHED Published: 2012-02-07T02:00:00 Last Updated: 2024-08-06T18:45:26.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in Opera 11.60 and earlier allow remote attackers to cause a denial of service (application crash) via a large integer argument to the (1) Int32Array, (2) Float32Array, (3) Float64Array, (4) Uint32Array, (5) Int16Array, or (6) ArrayBuffer function. NOTE: the vendor reportedly characterizes this as "a stability issue, not a security issue." Additional Analyst Notes: - CVE Program Container: References: - http://blog.vulnhunt.com/index.php/2012/02/02/cal-2012-0004-opera-array-integer-overflow/ - https:
tainer: References: - http://blog.vulnhunt.com/index.php/2012/02/02/cal-2012-0004-opera-array-integer-overflow/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/73027
CVE ID: CVE-2012-1004 State: PUBLISHED Published: 2012-02-08T02:00:00Z Last Updated: 2024-09-17T02:15:41.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text, (2) FirstName, (3) LastName, (4) OrganisationName, (5) OrganisationUrl, (6) Profession, (7) Country, (8) State, (9) Address, (10) Location, (11) Telephone, (12) VoIP, (13) InstantMessagingIM, (14) Email, (15) HomePage, or (16) Comment parameter. NOTE: some of these details are obtained from third party information. Additio
(15) HomePage, or (16) Comment parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://st2tea.blogspot.com/2012/02/foswiki-cross-site-scripting.html - http://secunia.com/advisories/47849 - http://foswiki.org/Support/SecurityAlert-CVE-2012-1004 - http://foswiki.org/Tasks/Item11501 - http://foswiki.org/Tasks/Item11498
CVE ID: CVE-2012-1005 State: PUBLISHED Published: 2012-02-07T21:00:00 Last Updated: 2024-08-06T18:45:26.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Sphinx Software Mobile Web Server 3.1.2.47 allow remote attackers to inject arbitrary web script or HTML via the comment parameter to a blog, as demonstrated using (1) Blog/MyFirstBlog.txt or (2) Blog/AboutSomething.txt. Additional Analyst Notes: - CVE Program Container: References: - http://secpod.org/blog/?p=453 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72913 - http://www.securityfocus.com/bid/51820 - http://secunia.com/advisories/47876
CVE ID: CVE-2012-1006 State: PUBLISHED Published: 2012-02-07T02:00:00 Last Updated: 2024-08-06T18:45:26.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders. Additional Analyst Notes: - CVE Program Container: References: - http://secpod.org/blog/?p=450 - http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt - https://exchange.xforce.ibmcloud.com/vulnerabil
.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/72888 - http://www.securityfocus.com/bid/51902
CVE ID: CVE-2012-1007 State: PUBLISHED Published: 2012-02-07T02:00:00 Last Updated: 2024-08-06T18:45:26.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do. Additional Analyst Notes: - CVE Program Container: References: - http://secpod.org/blog/?p=450 - http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt - http://www.oracle.com/technetwork/se
tp://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/73052 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - http://www.securityfocus.com/bid/51900
CVE ID: CVE-2012-1008 State: PUBLISHED Published: 2012-02-08T02:00:00 Last Updated: 2024-08-06T18:45:26.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: OfficeSIP Server 3.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted To header in a SIP INVITE message. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/18453 - http://secpod.org/exploits/SecPod_Exploit_OfficeSIP_Server_DOS.py - http://secpod.org/blog/?p=461 - http://secpod.org/advisories/SecPod_Exploit_OfficeSIP_Server_DOS_Vuln.txt
CVE ID: CVE-2012-1009 State: PUBLISHED Published: 2012-02-14T17:00:00 Last Updated: 2024-08-06T18:45:26.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetSarang Xlpd 4 Build 0100 and NetSarang Xmanager Enterprise 4 Build 0186 allow remote attackers to cause a denial of service (daemon crash) via a malformed LPD request. Additional Analyst Notes: - CVE Program Container: References: - http://secpod.org/advisories/SecPod_Exploit_NetSarang_Xlpd_Printer_Daemon_DoS_Vuln.txt - http://secpod.org/blog/?p=457 - http://www.securityfocus.com/bid/51821 - http://www.exploit-db.com/exploits/18454 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72933
CVE ID: CVE-2012-1010 State: PUBLISHED Published: 2012-02-07T21:00:00 Last Updated: 2024-08-06T18:45:26.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/18407 - http://www.securityfocus.com/bid/51615 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72640 - http://wordpress.org/extend/plugin
ityfocus.com/bid/51615 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72640 - http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/ - http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html - http://secunia.com/advisories/47659
CVE ID: CVE-2012-1011 State: PUBLISHED Published: 2012-02-07T21:00:00 Last Updated: 2024-08-06T18:45:26.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/18407 - http://www.securityfocus.com/bid/51615 - https://exchange.xforce.ibmcloud.com/vulnera
ww.exploit-db.com/exploits/18407 - http://www.securityfocus.com/bid/51615 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72640 - http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/ - http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html - http://secunia.com/advisories/47659
CVE ID: CVE-2012-1012 State: PUBLISHED Published: 2012-06-07T19:00:00Z Last Updated: 2024-09-17T02:10:32.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: server/server_stubs.c in the kadmin protocol implementation in MIT Kerberos 5 (aka krb5) 1.10 before 1.10.1 does not properly restrict access to (1) SET_STRING and (2) GET_STRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global list privilege. Additional Analyst Notes: - CVE Program Container: References: - http://src.mit.edu/fisheye/changelog/krb5/?cs=25704 - https://bugzilla.redhat.com/show_bug.cgi?id=796438 - http://krbdev.mit.edu/rt/Ticket/Disp
eye/changelog/krb5/?cs=25704 - https://bugzilla.redhat.com/show_bug.cgi?id=796438 - http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7093 - http://web.mit.edu/kerberos/krb5-1.10/
CVE ID: CVE-2012-1013 State: PUBLISHED Published: 2012-06-07T19:00:00 Last Updated: 2024-08-06T18:45:26.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: The check_1_6_dummy function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password. Additional Analyst Notes: - CVE Program Container: References: - http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7152 - http://www.securityfocus.com/bid/53784 - http://www.mandriva.co
u/rt/Ticket/Display.html?user=guest&pass=guest&id=7152 - http://www.securityfocus.com/bid/53784 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:102 - http://rhn.redhat.com/errata/RHSA-2012-1131.html - http://web.mit.edu/kerberos/krb5-1.10/ - https://bugzilla.redhat.com/show_bug.cgi?id=827517 - https://hermes.opensuse.org/messages/15083635 - https://github.com/krb5/krb5/commit/c5be6209311d4a8f10fda37d0d3f876c1b33b77b - http://mailman.mit.edu/pipermail/kerberos-announce/2012q2/000136.html
CVE ID: CVE-2012-1014 State: PUBLISHED Published: 2012-08-06T16:00:00 Last Updated: 2024-08-06T18:45:26.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a malformed AS-REQ request. Additional Analyst Notes: - CVE Program Container: References: - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt - http://lists.opensuse.org/opensuse-updates/2012-08/msg00016.
//web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt - http://lists.opensuse.org/opensuse-updates/2012-08/msg00016.html - http://www.debian.org/security/2012/dsa-2518
CVE ID: CVE-2012-1015 State: PUBLISHED Published: 2012-08-06T16:00:00 Last Updated: 2024-08-06T18:45:26.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kdc_handle_protected_negotiation function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x before 1.9.5, and 1.10.x before 1.10.3 attempts to calculate a checksum before verifying that the key type is appropriate for a checksum, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free, heap memory corruption, and daemon crash) via a crafted AS-REQ request. Additional Analyst Notes: - CVE Program Container: References: - http://web.mit.edu
crash) via a crafted AS-REQ request. Additional Analyst Notes: - CVE Program Container: References: - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt - http://rhn.redhat.com/errata/RHSA-2012-1131.html - http://lists.opensuse.org/opensuse-updates/2012-08/msg00016.html - http://www.debian.org/security/2012/dsa-2518 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:120
CVE ID: CVE-2012-1016 State: PUBLISHED Published: 2013-03-03T00:00:00 Last Updated: 2024-08-06T18:45:26.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pkinit_server_return_padata function in plugins/preauth/pkinit/pkinit_srv.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 attempts to find an agility KDF identifier in inappropriate circumstances, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted Draft 9 request. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55040 - http://web.mit.edu/kerberos/www
lyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55040 - http://web.mit.edu/kerberos/www/krb5-1.10/ - http://krbdev.mit.edu/rt/Ticket/Display.html?id=7527 - https://github.com/krb5/krb5/commit/db64ca25d661a47b996b4e2645998b5d7f0eb52c
CVE ID: CVE-2012-1017 State: PUBLISHED Published: 2012-02-08T00:00:00 Last Updated: 2024-08-06T18:45:26.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary SQL commands via the (1) ip_addr[0][1], (2) ip_addr[0][2], or (3) ip_addr[0][9] parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/18465 - http://secunia.com/advisories/47857 - http://www.securityfocus.com/bid/51874 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72998
CVE ID: CVE-2012-1018 State: PUBLISHED Published: 2012-02-08T00:00:00 Last Updated: 2024-08-06T18:45:27.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in includes/convert.php in D-Mack Media Currency Converter (mod_currencyconverter) module 1.0.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the from parameter. Additional Analyst Notes: - CVE Program Container: References: - http://dl.packetstormsecurity.net/1202-exploits/joomlacurrencyconverter-xss.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/72917 - http://www.securityfocus.com/bid/51804
CVE ID: CVE-2012-1019 State: PUBLISHED Published: 2012-02-08T00:00:00Z Last Updated: 2024-09-16T20:12:43.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in XWiki Enterprise 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) XWiki.XWikiComments_comment parameter to xwiki/bin/commentadd/Main/WebHome, (2) XWiki.XWikiUsers_0_company parameter when editing a user profile, or (3) projectVersion parameter to xwiki/bin/view/DownloadCode/DownloadFeedback. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com
tained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/47885 - http://www.securityfocus.com/bid/51867 - http://st2tea.blogspot.com/2012/02/xwiki-cross-site-scripting.html - http://packetstormsecurity.org/files/109447/XWiki-Enterprise-3.4-Cross-Site-Scripting.html
CVE ID: CVE-2012-1020 State: PUBLISHED Published: 2012-02-08T00:00:00 Last Updated: 2024-08-06T18:45:26.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in login.php in NexorONE Online Banking allow remote attackers to inject arbitrary web script or HTML via the (1) visitor_language parameter to register.php or (2) message parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/73001 - http://www.vulnerability-lab.com/get_content.php?id=304 - http://www.securityfocus.com/bid/51876 - http://secunia.com/advisories/47897 - http://marc.info/?l=full-disclosur
=304 - http://www.securityfocus.com/bid/51876 - http://secunia.com/advisories/47897 - http://marc.info/?l=full-disclosure&m=132852645911072&w=2