denashomes.ca XSS vulnerability

Vulnerable URL: http://www.denashomes.ca/listingresults.asp Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check denashomes.ca SSL...

Insecure Login Defaults

github.com/go-authboss/authboss is vulnerable to insecure login. The library successfully logs in when a confirmation link is clicked. This means a malicious user can log in if they obtain a confirmation or password reset link...

WordPress: Lack of Password Confirmation when Changing Password and Email

Hello Team, I noticed that it is not necessary to put your Password when Changing Emails, Password, etc.. which is easy to an attacker to Change it's Victim's Credentials when he hijack or takeover an account on wordpress forum account. Let me know if you need more information. Best Regards,...

Meh : CSRF in Facebook Delegated Account Recovery

Note this is going to be a quick post. This year, at Enigma 2017 Conference, Facebook introduced a way to move Account Recovery beyond Email and the "Secret" Question. After the presentation the moved operationally and presented the first integration partner : Github. These days I have seen a lot...

Threat Outbreak Alert RuleID28627: Email Messages Distributing Malicious Software on April 5, 2017

Medium Alert ID: 53346 First Published: 2017 April 5 18:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28627 may contain the following files: Name | Siz...

Airwatch 6.1.x / 6.4.x LDAP Injection

https://www.osisecurity.com.au/airwatch-self-service-portal-username-parameter-ldap-injection.html Date: 04-Apr-2017 Product: AirWatch Self Service MDM Versions affected: v6.1.x v6.4.x Vulnerability: LDAP injection Example: https://target/DeviceManagement/ URL accepts the following POST parameter...

it.monova.org XSS vulnerability

Vulnerable URL: https://it.monova.org/search Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinated Disclosure Timeline:...

kidshealth.org XSS vulnerability

Vulnerable URL: http://kidshealth.org/en/parents/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4943 VIP website status:| Yes Check kidshealth.org SSL connection:| Grade: B+...

Unauthorized Change Of Password

loopback is vulnerable to unauthorized password changes. The vulnerability exists as loopback accepts a change of user password without having the user to confirm their old password, leading to an account takeover. The attack is possible as long as an attacker can perform some form of social...

Steam Profile Integration 2.0.11 - SQL injection Vulnerability

Exploit for php platform in category web applications Exploit Title: IPS Community Suite - Steam Profile Integration 2.0.11 and below SQL injection Google Dork: inurl:tab=nodesteamsteamprofile Date: 13/03/2017 Exploit Author: DrWhat Vendor Homepage:...

Trello: Email authentication token fails to expire and can be used multiple times for same Email address on Trello.com

Hi there Trello Security Team , I have noticed a certain behaviour at https://trello.com . What I belief to be a bug . Summery: --------------------- You can authenticate an email added on your account with same authentication token multiple times . You remove it , add it again use the same token...

The vulnerability of Google Chrome browser allows a hacker to execute arbitrary code.

The vulnerability of Google Chrome arises from the lack of a need for users to confirm operations related to data loading. Exploiting this vulnerability allows a malicious actor to install a malicious extension and execute arbitrary code using a specially crafted HTML page...

Khan Academy: Rate Limitation Vulnerability (DDos)

Rate limiting on account confirmation emails and forgot password...

scallans.com XSS vulnerability

Vulnerable URL: https://www.scallans.com/grocery-shopping.php?idcat=48 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 21381575 VIP website status:| No Check scallans.com SSL...

CVE-2017-3278

Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite subcomponent: Request Confirmation. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-O...

aaii.com XSS vulnerability

Vulnerable URL: http://www.aaii.com/files/lightbox/emailsignup-prp.cfm?a="--!" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 105059 VIP website status:| No Coordinated Disclosure...

Oracle E-Business Suite Remote Security Vulnerability (CNVD-2017-00656)

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A remote vulnerability exists in Oracle One-to-One...

uaraus.altervista.org XSS vulnerability

Vulnerable URL: http://uaraus.altervista.org/index.php?filename=en/content/categories/Blender/DEMimporter.html'"--!confirmOPENBUGBOUNTY...

football-lineups.com XSS vulnerability

Vulnerable URL: http://www.football-lineups.com/my11/?t=EX-YU=Serbia' Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 220969 VIP website status:| No Check football-lineups.com SSL...

haitianbridge.org XSS vulnerability

Vulnerable URL: http://haitianbridge.org/search/search.php?s=%3Cimg%20src=x%20onerror=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...