2480 matches found
CVE-2017-11163
Cross-site scripting XSS vulnerability in aggregategraphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancelurl variable...
UBUNTU-CVE-2017-11163
Cross-site scripting XSS vulnerability in aggregategraphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancelurl variable...
CVE-2017-11163
Cross-site scripting XSS vulnerability in aggregategraphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancelurl variable...
DEBIAN-CVE-2017-11163
Cross-site scripting XSS vulnerability in aggregategraphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancelurl variable...
CVE-2017-11163
Cross-site scripting XSS vulnerability in aggregategraphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancelurl variable...
CVE-2017-11163
The CVE-2017-11163 entry corresponds to an XSS issue in Cacti: specifically, aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject script/HTML via crafted HTTP Referer headers, tied to the $cancel_url variable. Related CVE-2017-12066 covers the same XSS vector; t...
CVE-2017-11163
Cross-site scripting XSS vulnerability in aggregategraphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancelurl variable...
CVE-2017-11163
Cross-site scripting XSS vulnerability in aggregategraphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancelurl variable...
PT-2017-11788
Name of the Vulnerable Software and Affected Versions Cacti version 1.1.12 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the cancel url variable. Recommendation...
CVE-2017-11163: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in aggregategraphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancelurl variable...
Hopesys Web Management System version 1.0 /include/func.common.php referer header injection vulnerability
Hopesys website management system is based on LAMP development of enterprise/government website management system. Hopesys Website Management System version 1.0 /include/func.common.php referer header injection vulnerability. An attacker can use this vulnerability to obtain sensitive database...
SQL Injection Vulnerability in HTTP_REFERER on the Home Page of Uc365 Website Classifieds Navigation System
Uc365 website classification and navigation system is a cross-platform open source software, based on PHP + MYSQL development and construction of open source website classification and catalog management system. There is a SQL injection vulnerability in the index.php file on the home page of the...
Serendipity < 2.1.1 Multiple Vulnerabilities
According to its banner, the version of Serendipity running on the remote host is prior to 2.1.1. It is, therefore, affected by multiple vulnerabilities : - A stored cross-site scripting XSS vulnerability exists in the templates/2k11/admin/category.inc.tpl script due to improper validation of the...
ESPcms latest version has http header XSS vulnerability
ESSENCE ESPCMS website management system based on LAMP development and construction of the website management system. An http header XSS vulnerability exists in the latest version of ESPcms. The attacker triggers the cross-site vulnerability by modifying the Referer value to cross-site code...
ExpressionEngine: Open redirects protection bypass
Hello, When a redirect is to be issue on an ExpressionEngine instance, a request to the following URL is made: http://HOST/PATHTOEE/index.php?URL=TARGETURL Where TARGETURL is replaced with the actual URL we desire to redirect to. The script PATHTOEEDIR/system/ee/legacy/libraries/Redirect.php is t...
CVE-2016-3403
Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that 1 add, 2 modify, or 3 remove accounts by leveraging failure to use of a CSRF token and...
CVE-2016-3403
Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that 1 add, 2 modify, or 3 remove accounts by leveraging failure to use of a CSRF token and...
CVE-2016-3403
Zimbra Collaboration Server (Admin Console) vulnerable to multiple CSRF flaws in versions before 8.6.0 Patch 8. CSRF tokens and referer header checks are not enforced, enabling remote attackers to hijack administrator sessions and perform add/modify/remove account actions (bugs 100885/100899). Re...
New Relic: CSRF For Adding Users
Issue The API affected is https://rpm.newrelic.com/accounts/accountid/accountviews. Only admin users are allowed to add other new users, but a normal user with knowledge of the accountid can craft a webpage which does a CSRF when an admin user visits it. There are 2 problems with it that can resu...