9398 matches found
moz.com XSS vulnerability
Vulnerable URL: https://moz.com/blog/the-ultimate-guide-to-the-google-search-parameters/"'--! Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1636 VIP website status:| Yes Coordinated Disclosure Timeline:...
escapemotions.com XSS vulnerability
Vulnerable URL: https://www.escapemotions.com/blog.php?id="';--=interview-with-artist-junkyard-sam Details: Description| Value ---|--- Patched:| No Latest check for patch:| 08.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 160662 VIP website status:| No...
ShadowBrokers Releases NSA UNITEDRAKE Manual
The ShadowBrokers released the manual for UNITEDRAKE, a sophisticated NSA Trojan that targets Windows machines: Able to compromise Windows PCs running on XP, Windows Server 2003 and 2008, Vista, Windows 7 SP 1 and below, as well as Windows 8 and Windows Server 2012, the attack tool acts as a...
alebalweb-blog.com XSS vulnerability
Vulnerable URL: http://www.alebalweb-blog.com/cerca.php?q=prompt/OPENBUGBOUNTY/...
meridianplaza.com XSS vulnerability
Open Bug Bounty ID: OBB-288983 Description| Value ---|--- Affected Website:| meridianplaza.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Friday Squid Blogging: Bioluminescent Squid
There's a beautiful picture of a tiny squid in this New York Times article on bioluminescence -- and a dramatic one of a vampire squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Concrete CMS: 'cnvID' parameter vulnerable to Insecure Direct Object References
Installation Information === IIS 8, PHP 5.5, Concrete5 5.7.5.7 Default install Issue POC An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers. 1. An example blog with permission...
Default configuration
The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not...
CVE-2016-6800
The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not...
CVE-2016-6800
The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not...
CVE-2016-6800
The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not...
CVE-2016-6800
CVE-2016-6800 affects the Apache OFBiz blog feature: unsanitized input in the summary/article fields allows injection of arbitrary JavaScript, which is executed in users’ browsers visiting the article. Mitigation is to upgrade to Apache OFBiz 16.11.01. This vulnerability detail is supported by th...
CVE-2016-6800
The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not...
CVE-2016-6800: Improper Neutralization of Input During Web Page Generation
The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not...
PT-2017-9017
Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 16.11.01 Description The Apache OFBiz framework has a blog functionality that allows different users to operate blogs related to specific parties. The form fields for creating new blog articles do not properly...
The Next Generation of the Rapid7 Community
Rapid7s community is evolving! For the past several years, community.rapid7.com has been our platform for news and knowledge spanning blogs, questions, discussion, and documentation. We have tried to ensure that our community site has been a source of pragmatic, down-to-earth information and...
Cross-Site Request Forgery (CSRF)
intelliants/subrion is vulnerable to cross-site request forgery CSRF attacks. The library does not have the proper CSRF countermeasures in place, allowing a malicious user to delete an arbitrary blog post...
Friday Squid Blogging: Brittle Star Catches a Squid
Watch a brittle star catch a squid, and then lose it to another brittle star. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Plecost v1.1.1 - Wordpress Finger Printer Tool
What's Plecost? Plecost is a vulnerability fingerprinting and vulnerability finder for Wordpress blog engine. Why? There are a huge number of Wordpress around the world. Most of them are exposed to be attacked and be converted into a virus, malware or illegal porn provider, without the knowledge ...
blog-news.it XSS vulnerability
Vulnerable URL: https://www.blog-news.it/twitterscan.php?lang=%3C/script%3E%22%3E%3Csvg%20onload=prompt/OPENBUGBOUNTY/%3E=formula%20per%20un%20delitto Details: Description| Value ---|--- Patched:| No Latest check for patch:| 16.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...