HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability

Document Title: =============== HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1452 Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID: ====================================...

Barracuda Cloud Control 7.1.1.003 - XSS Web Vulnerability

Document Title: =============== Barracuda Cloud Control 7.1.1.003 - XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1992 Release Date: ============= 2018-07-16 Vulnerability Laboratory ID VL-ID: ====================================...

BMW - (Token) Cross Site Scripting Web Vulnerability

Document Title: =============== BMW - Token Cross Site Scripting Web Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1914 Video: https://www.youtube.com/watch?v=txjW7fpMJ-Q Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1737 Vulnerability...

HackerOne: Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com

Hi, I made a talk earlier this month about Client-Side Race Conditions for postMessage on AppSecEU: https://speakerdeck.com/fransrosen/owasp-appseceu-2018-attacking-modern-web-technologies In this talk I mention some fun ways to race postMessages from a malicious origin before the legit source...

Barracuda ADC 5.x Client-Side Script Insertion

Document Title: =============== Barracuda ADC 5.x - Client Side Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1425 Release Date: ============= 2018-07-10 Vulnerability Laboratory ID VL-ID:...

Barracuda ADC 5.x - CS Cross Site Scripting Vulnerability

Document Title: =============== Barracuda ADC 5.x - CS Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1425 Release Date: ============= 2018-07-10 Vulnerability Laboratory ID VL-ID: ====================================...

Information disclosure

An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to client-side when pages bookmarked in web portal use the Single Sign-On feature...

WordPress WP Live Chat Support Pro Remote Code Execution Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on PHP and MySQL servers.WP Live Chat Support Pro is a web chat plugin used in it. A remote code execution vulnerability exists in WordPress WP Liv...

CVE-2018-12426

The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remoteupload request with a .php filename and the image/jpeg content type...

CVE-2018-12426

The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remoteupload request with a .php filename and the image/jpeg content type...

Design/Logic Flaw

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

CVE-2018-1000556

WordPress version 4.8 + contains a Cross Site Scripting XSS vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacke...

Cross site scripting

WordPress version 4.8 + contains a Cross Site Scripting XSS vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacke...

CVE-2018-1000556

WordPress version 4.8 + contains a Cross Site Scripting XSS vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacke...

CVE-2018-1000556

WordPress version 4.8 + contains a Cross Site Scripting XSS vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacke...

DIGISOL DG-BR4000NG Cross-Site Scripting Vulnerability

DIGISOL DG-BR4000NG is a wireless router product from DIGISOL SYSTEMS, Mumbai. A cross-site scripting vulnerability exists in DIGISOL DG-BR4000NG. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of SSID client-side authentication only...

CVE-2018-12705

DIGISOL DG-BR4000NG devices have XSS via the SSID it is validated only on the client side...

CVE-2018-12705

DIGISOL DG-BR4000NG devices have XSS via the SSID it is validated only on the client side...

FortiOS SSL VPN webportal user credentials present in plain text in client side javascript file

An information disclosure vulnerability exists in the SSL-VPN web portal of FortiOS: when pages bookmarked in the web portal use the Single sign-on SSO feature, the user's webportal's login and password are included in a javascript file sent client-side. The leaked credential may potentially be...

Security Bulletin: IBM Worklight is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL might allow a remote attacker to obtain sensitive information, which is caused by an error in the TLS/DTLS heartbeat functionality. An attacker might exploit this...