Oracle PeopleSoft – XSS vulnerability

Application: Oracle PeopleSoft Vendor: Oracle Bug: XXS Reported: 31.10.2016 Vendor response: 1.11.2016 Date of Public Advisory: 17.01.2017 Reference: Oracle CPU Jan 2017 Authors: Vahagn Vardanyan, Dmitry Yudin VULNERABILITY INFORMATION Class: XSS CWE-79 Impact: steal information Remotely...

CVE-2016-3300

The CVE-2016-3300 Netlogon Elevation of Privilege vulnerability affects Windows 8.1, Windows Server 2012 (Gold/R2) and Windows RT 8.1, where Netlogon improperly establishes secure channels to a domain controller, enabling local privilege escalation on domain-joined machines. The root cause is in ...

Design/Logic Flaw

The guest portal in Cisco Identity Services Engine ISE 3300 1.20.899 does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045...

CVE-2015-6266

CVE-2015-6266 affects Cisco Identity Services Engine (ISE) guest portal, where the portal does not restrict access to uploaded HTML documents. The underlying issue is lack of access control for customized HTML files, allowing remote attackers to retrieve sensitive information by requesting the fi...

CVE-2015-6266

The guest portal in Cisco Identity Services Engine ISE 3300 1.20.899 does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045...

Debian: Security Advisory (DSA-3300-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-3300

CVE-2015-3300 covers multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress WordPress plugin (before 1.3.9.3). The affected components include checkout and admin pages, with exploitation possible through numerous input fields (billing/shipping address fields) and admin parameter ...

Multiple Vulnerabilities in TheCartPress WordPress plugin

Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public Disclosure: April 29, 2015 Vulnerabili...

WordPress TheCartPress 1.3.9 XSS / Local File Inclusion

Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public Disclosure: April 29, 2015 Vulnerabili...

WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities

WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor...

WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities

Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public Disclosure: April 29, 2015 Vulnerabili...

CVE-2014-7278 DoS in ZyXEL SBG-3300 Security Gateway

Vulnerability Title: DoS in ZyXEL SBG-3300 Security Gateway Date: 02/10/2014 CVE-ID: CVE-2014-7278 Product: ZyXEL SBG3300-N series Vendor: www.zyxel.com Affected Firmware: Latest version at the time of disclosure V1.00AADY.4C0 and below tested Patch: Unpatched Authored by: Mirko Casadei Disclosur...

ZyXEL SBG-3300 Security Gateway Cross Site Scripting Vulnerability

ZyXEL SBG-3300 Security Gateway suffers from a cross site scripting vulnerability. Vulnerability Title: Stored Server XSS in ZyXEL SBG-3300 Security Gateway Date: 02/10/2014 CVE-ID: CVE-2014-7277 Product: ZyXEL SBG3300-N series Vendor: www.zyxel.com Affected Firmware: Latest version at the time o...

ZyXEL SBG-3300 security vulnerabilities

DoS, crossite scripting...

CVE-2014-7277

Cross-site scripting XSS vulnerability in the login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00AADY.4C0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified "welcome message" form data that is improperly handled during rendering of the...

CVE-2014-7278

The login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00AADY.4C0 and earlier allows remote attackers to cause a denial of service persistent web-interface outage via JavaScript code within unspecified "welcome message" form data that is improperly handled during use for the loginM...

Design/Logic Flaw

The login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00AADY.4C0 and earlier allows remote attackers to cause a denial of service persistent web-interface outage via JavaScript code within unspecified "welcome message" form data that is improperly handled during use for the loginM...

Cross site scripting

Cross-site scripting XSS vulnerability in the login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00AADY.4C0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified "welcome message" form data that is improperly handled during rendering of the...

CVE-2014-7278

The login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00AADY.4C0 and earlier allows remote attackers to cause a denial of service persistent web-interface outage via JavaScript code within unspecified "welcome message" form data that is improperly handled during use for the loginM...

CVE-2014-7277

The ZyXEL SBG-3300 Security Gateway (firmware up to 1.00(AADY.4)C0) is affected by CVE-2014-7277, a Stored Server XSS in the login page. The vulnerability arises from improper handling of the loginMessage element during rendering of the login page, allowing remote attackers to inject arbitrary we...