Hotspot Express hotEx Billing Manager Cross-Site Scripting Vulnerability

Hotspot Express is a complete WiFi solution from Hotspot Express India that manages and protects wired and wireless networks. hotEx Billing Manager is one of the software solutions that integrates Captive Portal, AAA and Billing for WiFi hotspot management. Hotspot Express hotEx Billing Manager i...

CVE-2015-3319

Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

Design/Logic Flaw

Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2015-3319

Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2015-3319

CVE-2015-3319 affects Hotspot Express hotEx Billing Manager version 73. The root cause is absence of the HttpOnly flag in Set-Cookie headers, enabling potential access to cookies via client-side scripts by remote attackers. Multiple sources (NVD entry and CNVD/OpenVAS notes) corroborate this expo...

Hotspot Express hotEx Billing Manager cgi-bin/hotspotlogin.cgi Cross-Site Scripting Vulnerability

Hotspot Express hotEx Billing Manager is a billing management system. A cross-site scripting vulnerability in Hotspot Express hotEx Billing Manager cgi-bin/hotspotlogin.cgi allows attackers to submit special reply parameters to inject malicious HTML or scripts and obtain sensitive information...

CVE-2015-2781

Cross-site scripting XSS vulnerability in cgi-bin/hotspotlogin.cgi in Hotspot Express hotEx Billing Manager 73 allows remote attackers to inject arbitrary web script or HTML via the reply parameter...

CVE-2015-2781

CVE-2015-2781 describes a cross-site scripting (XSS) vulnerability in Hotspot Express hotEx Billing Manager 73, via the hotspotlogin.cgi parameter reply. A malicious user can inject script into pages viewed by other users; PoC shows script execution (e.g., alert(document.cookie)). The vulnerable ...

Slack: Team admin can add billing contacts

Billing contacts can only be added by team owners. However, team admin can escalate his privileges and add billing contacts. Steps to reproduce: 1.Log in as team admin 2.Send the below request using his token and it adds '[email protected]' to billing contacts. POST /api/team.billing.addContact...

Oracle E-Business Multiple Vulnerabilities (January 2015 CPU)

The version of Oracle E-Business installed on the remote host is missing the January 2015 Oracle Critical Patch Update CPU. It is, therefore, affected by vulnerabilities in the following components : - Oracle Application Object Library - Oracle Applications DBA - Oracle Applications DBA - Oracle...

Unspecified Vulnerability in Oracle E-Business Suite Oracle Telecommunications Billing Integrator Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. A security vulnerability exists in the Oracle E-Business Suite Oracle Telecommunications Billing Integrator component that could be exploited by remote attackers to compromise system integrity...

CVE-2015-0380

Unspecified vulnerability in the Oracle Telecommunications Billing Integrator component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to OA Based UI for Bill...

CVE-2015-0380

Unspecified vulnerability in the Oracle Telecommunications Billing Integrator component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to OA Based UI for Bill...

CVE-2015-0380

Unspecified vulnerability in the Oracle Telecommunications Billing Integrator component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to OA Based UI for Bill...

Hacking Smart Electricity Meters To Cut Power Bills

Smart devices are growing at an exponential pace with the increase in connecting devices embedded in cars, retail systems, refrigerators, televisions and countless other things people use in their everyday life, but security and privacy are the key issues for such applications, which still face...

Verizon to Pay Largest Ever Consumer Privacy Settlement

Verizon will pay the Federal Communications Commission $7.4 million as part of a settlement over the company’s failure to adequately inform and obtain consent from customers before using their personal information to develop thousands of tailored marketing campaigns. Officials say this fine...

ExpressionEngine: Cross Site Scripting (Stored)

Occurred in the URL : https://store.ellislab.com/billing After adding a product to the cart proceed to add the billing and card information and in the card fields give your card details respectively and in the fields 1. First name 2. Last name 3. Street Address 4. Apt/Suite/ 5. City. Give the...

ASTPP VoIP Billing (4cf207a) Multiple Vulnerabilities

No description provided by source. Title: ====== ASTPP VoIP Billing 4cf207a - Multiple Web Vulnerabilities Date: ===== 2012-08-17 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=687 VL-ID: ===== 687 Common Vulnerability Scoring System: ==================================...

Advanced Webhost Billing System 2.2.2 Contact.PHP Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/19226/info Advanced Webhost Billing System AWBS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage any of these issues to have...

OpenEMR 3.2.0 - SQL Injection and XSS

No description provided by source. Exploit Title: OpenEMR v3.2.0 Multiple Vulnerabilities Date: December 26, 2010 Author: Blake Software Link: http://sourceforge.net/projects/openemr/ Version: 3.2.0 Tested on: Windows XP SP3 Description: Open Source Practice Management, Electronic Medical Record,...