Mustlive

A problematic vulnerability was found in the Subscribe to Comments Plugin, affecting an unknown part of the file subscribe-to-comments.php. The manipulation leads to cross site scripting and can be initiated remotely.

Foi encontrada uma vulnerabilidade problemática no componente Formulário de Contato do Bitrix Site Manager. O problema decorre da manipulação do argumento `text` com uma entrada maliciosa, como `<img src="http://1"; on onerror="$(’p').text(’Hacked’)" />`, levando a um cross-site scripting básico. Este ataque pode ser lançado remotamente. A exploração foi divulgada publicamente e pode estar em uso.

A vulnerabilidade permite que invasores remotos injetem scripts da Web ou HTML arbitrários por meio dos parâmetros `link`, `logo.link` ou `aboutlink`, ou de um nome de esquema URI aninhado para `javascript`, `asfunction` ou `vbscript`. Isso permite que invasores executem scripts maliciosos no lado do cliente.

The issue allows remote attackers with control of a sub-domain belonging to a victim domain to cause a denial of service. This is achieved via the `url` parameter to the "plugin googlemap3 kmlprxy.php" endpoint.

Name of the Vulnerable Software and Affected Versions: Joomla Googlemaps plugin versions prior to 3.1 Description: The issue allows remote attackers to cause a denial of service. This can be achieved via the `url` parameter to the "plugin googlemap2 proxy.php" endpoint. Recommendations: For versions prior to 3.1, update to version 3.1 or later to resolve the issue.

A cross-site scripting (XSS) issue exists in the web server of IBM Domino when Webmail is enabled. This allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that change the administrator password via a request to "start apply.htm".

The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters. The parameters `next page`, `group id`, `action script`, or `flag` in the "start apply.htm" endpoint are affected.

A cross-site request forgery (CSRF) issue exists in the retrospam component, allowing remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list. This occurs due to a vulnerability in the wp-admin/options-discussion.php file.

General information about the issue is not available.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter in the c.php file.

A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by providing a .. (dot dot) in the `bn` parameter of the search.php3 (also known as search.php) file.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the `bn` parameter in the "search.php3" (also known as "search.php") file.

The issue arises from improper handling of missing files, specifically the README, ChangeLog, and LICENSE files. This allows remote attackers to determine the installation path by requesting a nonexistent file.

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to injecting a Refresh header or specifying the content of a Refresh header in HTTP responses, due to the failure to block javascript: URIs in Refresh headers.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `artid` parameter in the printfeature.php file.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `sid` parameter in the "print.php" file.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `sid` parameter in the "print.php" file.

The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the `css str` parameter in an edit action.

The issue allows remote attackers to inject arbitrary web script or HTML via the `captcha ttffolder`, `captcha numchars`, `captcha ttfrange`, or `captcha secret` parameters in the captcha/captcha.php file.