CaseAware Cross Site Scripting

Exploit Title: CaseAware Cross Site Scripting Vulnerability Date: 20th May 2017 Exploit Author: justpentest Vendor Homepage: https://caseaware.com/ Version: All the versions Contact: [email protected] CVE : 2017-5631 Source:...

CVE-2016-10329

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

CVE-2016-10329

Affected product: Synology Photo Station (prior to version 6.5.3-3226). Vulnerability: Command injection in login.php that allows remote attackers to execute arbitrary code through shell metacharacters in a crafted X-Forwarded-For header. Impact: Remote code execution with high risk (as noted by ...

CVE-2016-10329: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

CVE-2017-8295

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to...

CVE-2017-8295: Weak Password Recovery Mechanism for Forgotten Password

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to...

Cross site scripting

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter i.e., "usr" that is transmitted in the login.php query string...

CVE-2017-5631

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter i.e., "usr" that is transmitted in the login.php query string...

PT-2017-16631

Name of the Vulnerable Software and Affected Versions KMCIS CaseAware affected versions not specified Description An issue was discovered in KMCIS CaseAware, where reflected cross-site scripting is present in the usr parameter transmitted in the "login.php" query string. Recommendations At the...

CVE-2017-5631: Improper Neutralization of Input During Web Page Generation

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter i.e., "usr" that is transmitted in the login.php query string...

CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

CVE-2016-10322: Improper Neutralization of Special Elements used in a Command

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

PT-2017-7860

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.3-2958 Description The issue allows remote authenticated guest users to execute arbitrary commands. This can be achieved by using shell metacharacters in the X-Forwarded-For HTTP header to the...

ciao.de XSS vulnerability

Vulnerable URL: https://www.ciao.de/login.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 34306 VIP website status:| Yes Check ciao.de SSL connection:| Grade: A Coordinated...

yelites.org XSS vulnerability

Vulnerable URL: http://www.yelites.org/web/login.php?err=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3059223 VIP website status:| No Check yelites.org SSL connection:| Grade: ...

hckrs.ir XSS vulnerability

Vulnerable URL: http://hckrs.ir/login.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3771032 VIP website status:| No Check hckrs.ir SSL connection:| Grade: F Coordinated...

jaipurad.com XSS vulnerability

Vulnerable URL: http://www.jaipurad.com/login.php?msg=%22%22/%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E=internal.php Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 12:44 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

dailypioneer.com XSS vulnerability

Vulnerable URL: http://www.dailypioneer.com/cms/login.php?msg=OPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 52961 VIP website status:| No Check dailypioneer.com SSL...

pilotschedule.com XSS vulnerability

Vulnerable URL: http://www.pilotschedule.com/login.php?msg=...

edu.mapf.ir XSS vulnerability

Vulnerable URL: http://edu.mapf.ir/login.php?redirect=" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check edu.mapf.ir SSL connection:| Grade: F Coordinated...