The calendar application for Apache Tomcat contains invalid HTML which renders the cross site scripting protection for the time parameter ineffective. An attacker can therefore perform an cross site scripting attack using the time attribute. Version affected include Tomcat 6.0.0 to 6.0.18, Tomcat 5.5.0 to 5.5.27, and Tomcat 4.1.0 to 4.1.39.
Multiple modules from editeurscripts.com suffer from cross site scripting vulnerabilities.These include EsContacts version 1.0, EsBaseAdmin version 2.1, EsPartenaires version 1.0, and EsNews version 1.2.
Hannon Hill's Cascade Server product is vulnerable to a command execution vulnerability. An attacker with access to an unprivileged account within Cascade Server could exploit this vulnerability to run arbitrary commands on the system with the privileges of the user who started Cascade Server. Exploit included.
The eXtplorer file management component for Joomla! and Mambo suffers from a local file inclusion vulnerability that allows for remote code execution. Versions below 2.0.0 are vulnerable.