Information disclosure

An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04US, DCS-1130 1.03/1.04US , DCS-2102 1.05RU/1.06/1.06FR/1.05TESCO, DCS-2121...

CVE-2013-1602

An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04US, DCS-1130 1.03/1.04US , DCS-2102 1.05RU/1.06/1.06FR/1.05TESCO, DCS-2121...

Chrome for Android Enables Site Isolation Security Feature for All Sites with Login

After enabling 'Site Isolation' security feature in Chrome for desktops last year, Google has now finally introduced 'the extra line of defence' for Android smartphone users surfing the Internet over the Chrome web browser. In brief, Site Isolation is a security feature that adds an additional...

Siemens Spectrum Power Cross-Site Scripting Vulnerability

Siemens Spectrum Power is a system that provides the basic components for SCADA, communication and data modeling of control and monitoring systems. A cross-site scripting vulnerability exists in Siemens Spectrum Power. A remote attacker can exploit this vulnerability to execute arbitrary script...

Multiple VPN applications insecurely store session cookies

A research of Software Engineering Institute of the Carnegie Mellon University shows that multiple VPN applications store the authentication and/or session cookies insecurely in memory and/or log files. CVE: CVE-2019-1573 CVE-2016-8201 Last updated: April 12, 2019, 8:17 p.m...

F5 Networks BIG-IP : TMM TLS virtual server vulnerability (K10065173)

A BIG-IP virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle MITM attack, despite the attacker not having gained access to t...

Cross-site Scripting (XSS)

Microsoft.AspNet.SignalR is vulnerable to cross-site scripting XSS attack. The application does not properly sanitize user-supplied input before displaying it. This can allow a malicious user to inject and execute arbitrary code in the target user's browser which can lead to access to...

D-Link DIR-815 Cross-Site Scripting Vulnerability (CNVD-2018-08947)

D-Link DIR-815 REV.B is a wireless router product from AUO D-Link. A cross-site scripting vulnerability exists in the D-Link DIR-815 REV. B using firmware DIR-815REVBFIRMWAREPATCH2.07.B01 and prior versions. A remote attacker can exploit this vulnerability by sending the 'RESULT' parameter to the...

D-Link DIR-815 Cross-Site Scripting Vulnerability

D-Link DIR-815 REV.B is a wireless router product from AUO D-Link. A cross-site scripting vulnerability exists in the D-Link DIR-815 REV. B using firmware DIR-815REVBFIRMWAREPATCH2.07.B01 and prior versions. A remote attacker can exploit this vulnerability by sending the 'Treturn' parameter to th...

D-Link DIR-850L REV.A Cross-Site Scripting Vulnerability

The D-Link DIR-850L REV.A is a wireless router from AUO D-Link. A cross-site scripting vulnerability exists in the D-Link DIR-850L REV.A using firmware version FW114WWb07h2abbeta1 and earlier. A remote attacker can exploit the vulnerability to steal authentication cookies by sending the 'action'...

Palo Alto PAN-OS cross-site scripting vulnerability (CNVD-2017-31599)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. Palo Alto Networks PAN-OS suffers from a cross-site scripting vulnerability that stems from a failure to adequately validate user input. An attacker could use this vulnerability to...

Security update for xorg-x11-server (important)

This update for xorg-x11-server fixes the following issues: - CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. bnc1035283 - Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the allowed range. - CVE-2017-10972: Initialize t...

EulerOS 2.0 SP1 : openssh (EulerOS-SA-2016-1008)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that the OpenSSH server did not sanitize data received in requests to enable X11 forwarding. An authenticated client with...

Urban Dictionary: Session replay vulnerability in www.urbandictionary.com

Session replay vulnerability in www.urbandictionary.com I considered titling this bug "Session tokens not expiring", which is what you need to tell your development team. But I titled it as I did to emphasize at least one attack made possible by the bug. There may be others. Description Privilege...

CVE-2016-0217

IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web...

Multiple Cross-Site Scripting Vulnerabilities in Drupal Doubleclick for Publishers Module

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. Multiple cross-site scripting vulnerabilities exist in the Drupal Doubleclick for Publishers module. The vulnerabilities can be exploited to execute arbitrary script code ...

Open-Xchange (OX) App Suite 'authentication cookies' Information Disclosure Vulnerability

Open-Xchange OX App Suite is prone to an information disclosure vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program ...

Open-Xchange (OX) App Suite 'authentication cookies' Information Disclosure Vulnerability

Open-Xchange OX App Suite is prone to an information disclosure vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program ...

CVE-2016-4027

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store cookies that exceed the session duration. This functionality is useful when logging in from clients with reduced privileges or shared environments. However t...

Netgear R7000 - Cross-Site Scripting

Exploit Title: Netgear R7000 - XSS via. DHCP hostname Date: 11-12-2016 Exploit Author: Vincent Yiu Contact: https://twitter.com/vysecurity Vendor Homepage: https://www.netgear.com/ Category: Hardware / WebApp Version: V1.0.7.21.1.93 + LATEST to date -Vulnerability An user who has access to send...