77 matches found
shadow 跨站脚本漏洞
shadow is a suite of tools for maintaining Debian systems. A cross-site scripting vulnerability exists in shadow web wdja, which stems from the product's /php/passport/index.php file failing to properly handle data in the backurl parameter. An attacker could use this vulnerability to execute...
U.S. Dept Of Defense: DOM Based XSS on https://████ via backURL param
Description: The following endpoint suffers from DOM Based XSS https://████████/██████=javascript:alertdocument.domain The ████████ param determines the content which will be displayed on the "Back to Search Result" button, eventually leading to RXSS. References ██████ Regards nagli Impact...
Mail.ru: [account.mail.ru] XSS на странице удаления аккаунта через backUrl
Недостаточная валидация параметра backUrl даёт возможность указать javascript-ссылку: https://account.mail.ru/user/delete?backUrl=javascript:alertdocument.domain javascript getBackUrl: function url return /^http/.testurl ? url : this.urlData.backUrl || this.config.get'backUrl' ||...
SS-2016-016: XSS In CMSSecurity BackURL
More info at https://www.silverstripe.org/download/security-releases/ss-2016-016/...
IBM Cognos Business Intelligence Tivoli Common Reporting Security Bypass Vulnerability
IBM Cognos Business Intelligence BI and IBM Tivoli Common Reporting TCR are both products of IBM Corporation, U.S.A. BI is a set of business intelligence software. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such...
Design/Logic Flaw
IBM Tivoli Common Reporting TCR 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 allows local users to bypass the Cognos Application...
CVE-2015-7435
IBM Tivoli Common Reporting TCR 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 allows local users to bypass the Cognos Application...
IBM Cognos Business Intelligence Developer 10.2.1 Open Redirect
IBM Cognos Business Intelligence Developer 10.2.1 backURL Open Redirect Vendor: IBM Corporation Product web page: http://www.ibm.com Affected version: 10.2.1 Build 10.2.5000.267 Trial Summary: IBM Cognos Business Intelligence is a web-based, integrated business intelligence suite by IBM. It...
Oracle Identity Manager (October 2014 CPU
The remote host is missing the October 2014 Critical Patch Update for Oracle Identity Manager. It is, therefore, affected by multiple vulnerabilities : - The application is affected by a vulnerability in Apache Commons BeanUtils in which ClassLoader objects can be set via the class attribute of a...
SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure
source: https://www.securityfocus.com/bid/61578/info SilverStripe is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. SilverStripe 3.0.3 is vulnerable; other versions may also be affected...
CVE-2011-2904
Cross-site scripting XSS vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter...
DEBIAN-CVE-2011-2904
Cross-site scripting XSS vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter...
CVE-2011-2904
Cross-site scripting XSS vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter...
CVE-2011-2904
Cross-site scripting XSS vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter...
CVE-2011-2904
Cross-site scripting XSS vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter...
CVE-2010-1905
Multiple cross-site scripting XSS vulnerabilities in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allow remote attackers to inject arbitrary web script or HTML via crafted input to ASP pages, as demonstrated using the backurl parameter to...
CVE-2007-5979
Cross-site scripting XSS vulnerability in downloadplugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter...