Aung Khant

The issue is related to a Cross-Site Scripting (XSS) problem. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or control.

The issue is related to SQL Injection via the `filter order` and `filer order Dir` parameters. This allows for potential exploitation.

The issue concerns a cross-site scripting (XSS) flaw in the /bb-login.php URL, specifically via the `re` parameter. This allows for potential malicious script injection. No information is provided about the estimated number of affected devices or real-world incidents.

The issue is related to a cross-site scripting (XSS) vulnerability. It affects the /vanilla/index.php endpoint via the `p` parameter.

A Cross-site Request Forgery (CSRF) issue exists due to inadequate confirmation for sensitive transactions in the administrator functions.

Multiple Cross-site Scripting (XSS) vulnerabilities exist in the index.php file, specifically in the `search word`, `extension`, `asset`, and `author` parameters. This issue allows for potential exploitation through these parameters in the "/index.php" endpoint.

A Cross Site Request Forgery (CSRF) issue exists in the administrator functions due to inadequate confirmation for sensitive transactions.

A Cross-Site Scripting (XSS) issue exists in the `g` parameter to "index.php" in Jcow CMS.

A Code Execution issue exists in the `attachment` parameter to "index.php" in Jcow CMS.

An Arbitrary File Upload issue exists due to a failure to restrict uploaded files with certain extensions, such as `.htaccess`, `.php4`, `.php5`, and `.phtl`. This issue is related to the `admin/media/upload.php` file.

A Cross-Site Scripting (XSS) issue exists in the `rcID` parameter.

The issue is related to a SQL injection vulnerability.

The issue arises from improper sanitization of the `internalname` parameter, allowing an attacker to conduct a Cross Site Scripting attack. This could enable an attacker to create a specially crafted URL that executes arbitrary script code in a victim's browser.

The issue allows local users to gain privileges via a Trojan horse `java msci.dll` or `msci java.dll` file in the current working directory. This can be demonstrated by a directory that contains a .doc, .xls, or .odg file.

The issue allows local users to gain privileges via a Trojan horse `patchani.dll` file in the current working directory. This can be demonstrated by a directory containing specific file types, including `.ani`, `.bmp`, `.cal`, `.hdp`, `.jpe`, `.mac`, `.pbm`, `.pcx`, `.pgm`, `.png`, `.psd`, `.ras`, `.tga`, or `.tiff` files.

The issue allows local users to gain privileges through multiple untrusted search path vulnerabilities. This can be achieved by placing a Trojan horse `java msci.dll` or `msci java.dll` file in the current working directory, particularly in a directory that contains a `.psw` file.

A directory traversal issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the `select users template` parameter to the "index.php" endpoint.

The issue concerns untrusted search path vulnerabilities in multiple components of Kingsoft Office 2010, including Presentation, Writer, and Spreadsheets. This allows local users to gain privileges by placing a Trojan horse `plgpf.dll` file in the current working directory, potentially exploiting the vulnerability when the directory contains specific file types such as .xls, .ppt, .rtf, or .doc.

The issue allows local users to gain privileges via a Trojan horse `eclipse 1114.dll` or `emser645mi.dll` file in the current working directory. This can be demonstrated by a directory that contains a file with certain extensions, such as `.odm`, `.odt`, `.otp`, `.stc`, `.stw`, `.sxg`, or `.sxw`.

The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to multiple scripts, including `join.php`, `search.php`, `photo search.php`, and `photo view.php`. The vulnerable parameters include `user`, `email`, `email2`, `f17 zip`, `agree`, `PATH INFO`, `st`, `f17 city`, `f17 country`, `f17 state`, `f19`, `wphoto`, `search`, `v`, and `return`.