Sony

Name of the Vulnerable Software and Affected Versions: Jamroom versions prior to 4.2.7 Description: A Cross Site Scripting (XSS) issue exists via the Status Update field. This allows for malicious script execution. Recommendations: For versions prior to 4.2.7, update to version 4.2.7 or later to resolve the issue.

A cross-site scripting (XSS) issue exists in the getLog function in svnlook.php, allowing remote attackers to inject arbitrary web script or HTML via the `path` parameter to API endpoints such as "comp.php", "diff.php", or "revision.php".

The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in the statistik.php file. The vulnerable parameters include the `action` parameter, the `show` parameter in a `stat tld` action, and the `order` parameter in a `stat abfragen` action.

The issue allows remote attackers to load arbitrary web site pages into frames, which can be used to conduct phishing attacks. This is achieved via the `url` parameter in the tiki-featured link.php file.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `f` parameter. This can lead to the execution of malicious code on the victim's browser.

The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the `windowed` parameter in the "login.cfm" file.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the `shopping url` parameter in the webscr.php file.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `Loginname` parameter in the forums/ubbthreads.php file.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via certain vectors, possibly a crafted ticket description in the Tickets/Submit functionality.

The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters. The parameters `cus email`, `help name`, `help email`, `help website`, and `help example url` are vulnerable in certain actions.

A cross-site scripting (XSS) issue exists in the Zimbra Web Client, specifically in the zimbra/h/calendar component. This allows remote attackers to inject arbitrary web script or HTML via the `view` parameter.

The issue is related to a cross-site scripting (XSS) vulnerability in the smwfOnSfSetTargetName function. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `target` parameter to the "index.php/Special:FormEdit" endpoint.

The issue allows remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via various parameters, including `text`, `FirstName`, `LastName`, `OrganisationName`, `OrganisationUrl`, `Profession`, `Country`, `State`, `Address`, `Location`, `Telephone`, `VoIP`, `InstantMessagingIM`, `Email`, `HomePage`, or `Comment`.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `XWiki.XWikiComments comment` parameter to "xwiki/bin/commentadd/Main/WebHome", the `XWiki.XWikiUsers 0 company` parameter when editing a user profile, or the `projectVersion` parameter to "xwiki/bin/view/DownloadCode/DownloadFeedback".

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the organization field in a profile. This can occur during (1) registration or (2) editing of the user.