CVE-2017-15572

In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information password reset tokens by reading a Referer log, because account/lostpassword does not use a redirect...

CVE-2017-15572

In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information password reset tokens by reading a Referer log, because account/lostpassword does not use a redirect...

CVE-2017-15572

In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information password reset tokens by reading a Referer log, because account/lostpassword does not use a redirect...

PT-2017-14104

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 3.2.6 Redmine versions 3.3.x prior to 3.3.3 Description The issue allows remote attackers to obtain sensitive information, specifically password reset tokens, by reading a Referer log. This is because the account/lost...

CVE-2017-15572: Insertion of Sensitive Information into Log File

In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information password reset tokens by reading a Referer log, because account/lostpassword does not use a redirect...

PT-2017-14048

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 62.0.3202.62 Opera affected versions not specified Description The issue is related to Insufficient Policy Enforcement in Devtools remote debugging, allowing a remote attacker to obtain access to remote debuggin...

Avito: CSS injection in avito.ru via IE11

Hi Team Security @avito I discovered CSS Injection on avito.ru in form search via IE11 Description CSS injection vulnerabilities arise when an application imports a style sheet from a user-supplied URL, or embeds user input in CSS blocks without adequate escaping. They are closely related to...

Cross site request forgery (csrf)

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...

CVE-2016-6806: Cross-Site Request Forgery (CSRF)

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...

CVE-2016-6806

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...

SmarterStats 11.3.6347 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications ---------------------------- Title: CVE-2017-14620 ---------------------------- TL;DR: SmarterStats Version 11.3.6347, and possibly prior versions, will Render the Referer Field of HTTP Logfiles in URL /Data/Reports/ReferringURLsWithQueries...

PT-2017-9021

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 6.x through 6.24.0 Apache Wicket versions 7.x through 7.4.0 Apache Wicket version 8.0.0-M1 Description The issue concerns a CSRF prevention measure that fails to identify certain cross-origin requests. This is because it...

CVE-2017-14620

SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in Stored Cross Site Scripting...

Cross site scripting

SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in Stored Cross Site Scripting...

CVE-2017-14620: Improper Neutralization of Input During Web Page Generation

SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in Stored Cross Site Scripting...

PT-2017-13586

Name of the Vulnerable Software and Affected Versions SmarterStats version 11.3.6347 Description The issue concerns a stored cross-site scripting problem. It occurs when the Referer Field of HTTP logfiles is rendered from the URL /Data/Reports/ReferringURLsWithQueries, allowing for potential...

CVE-2015-7391

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...

CVE-2015-7391

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...

CVE-2015-7391

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...

Student Result or Employee Database <= 1.6.3 - Auth Bypass

The Student Result or Employee Database WordPress plugin was affected by an Auth Bypass security vulnerability. curl -i -s -k -X 'POST' -H 'User-Agent: Mozilla/5.0' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'X-Requested-With: XMLHttpRequest' -H 'Referer:...