2474 matches found
PT-2019-11768 · Jenkins · Jenkins Gitlab Authentication Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Gitlab Authentication Plugin version 1.4 and earlier Description: The issue allows attackers to redirect users to a URL outside Jenkins after a successful login, implementing an open redirect. This can be used by malicious sites to...
Open redirect vulnerability in gitlab-oauth
gitlab-oauth records the HTTP Referer header when the authentication process starts and redirects users to that URL when the user has finished logging in. This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to...
CVE-2019-6726
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wppostratingsclearfastestcache and rmfolderrecursively in wpFastestCache.php mishandle ../ in an HTTP Referer header...
CVE-2019-6726
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wppostratingsclearfastestcache and rmfolderrecursively in wpFastestCache.php mishandle ../ in an HTTP Referer header...
CVE-2019-6726
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wppostratingsclearfastestcache and rmfolderrecursively in wpFastestCache.php mishandle ../ in an HTTP Referer header...
PT-2019-18286
Name of the Vulnerable Software and Affected Versions WP Fastest Cache plugin versions prior to 0.9.0 Description The issue allows remote attackers to delete arbitrary files due to mishandling of ../ in an HTTP Referer header by the wp postratings clear fastest cache and rm folder recursively...
CVE-2019-6726: Improper Limitation of a Pathname to a Restricted Directory
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wppostratingsclearfastestcache and rmfolderrecursively in wpFastestCache.php mishandle ../ in an HTTP Referer header...
CVE-2017-17972
packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362...
CVE-2017-17972
packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362...
CVE-2017-17972: Improper Neutralization of Input During Web Page Generation
packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362...
PT-2019-8253
Name of the Vulnerable Software and Affected Versions Archon version 3.21 rev-1 Description The issue concerns an XSS vulnerability in the referer parameter of an index.php?subjecttypeid=xxx request, specifically in the subjects.php file within the packages/subjects/pub directory. This...
LiveChat <= 3.7.2 - Unauthenticated Option Update/Reset and Stored XSS
The lack of proper CSRF and Authorisation checks could allow an unauthenticated attacker to update or reset the plugin's settings. Furthermore, when updating the livechatemail option, no sanitisation is performed, leading to a Stored XSS issue in the plugin's settings page. CSRF and XSS fixed in...
Cross site scripting
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
CVE-2019-12362
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
CVE-2019-12362
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
CVE-2019-12362
CVE-2019-12362 affects EmpireCMS 7.5.0. The vulnerability is an XSS flaw exploitable via the HTTP Referer header to the endpoint e/member/doaction.php, as documented across Red Hat, NVD, CVE lists and CNVD/CVELIST entries. The available sources identify a cross-site scripting risk in EmpireCMS 7....
CVE-2019-12362
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
CVE-2019-12362: Improper Neutralization of Input During Web Page Generation
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
PT-2019-12764
Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.5.0 Description The issue allows for XSS via the HTTP Referer header to the "e/member/doaction.php" endpoint. Recommendations For EmpireCMS version 7.5.0, update to a version that fixes this issue, or as a temporary...