Stored Cross-site Scripting Vulnerability in the Frontend of Guojiz Web Site Navigation System

Guojiz website navigation system is a navigation website source code developed by PHP+MySQL. A stored cross-site scripting vulnerability exists in the frontend of the Guojiz web navigation system. An attacker can exploit the vulnerability to obtain sensitive information such as user cookies...

EvilApp - Phishing Attack Using An Android App To Grab Session Cookies For Any Website (ByPass 2FA)

Man-in-the-middle phishing attack using an Android app to grab session cookies for any website, which in turn allows to bypass 2-factor authentication protection. EvilApp brings as an example the hijacking and injection of cookies for authenticated instagram sessions. Legal disclaimer: Usage of...

XSS Vulnerability in Tianniu Website Builder System

Tianniu website builder is an extremely fast online website builder platform. An XSS vulnerability exists in the Tianniu website builder system, which can be exploited by an attacker to obtain user cookie information...

XSS Vulnerability in Extreme CMS Frontend

Extreme CMS is a website building system. An XSS vulnerability exists in the frontend of Extreme CMS, which can be exploited by attackers to obtain user cookie information...

Self-XSS - Self-XSS Attack Using Bit.Ly To Grab Cookies Tricking Users Into Running Malicious Code

Self-XSS attack using bit.ly to grab cookies tricking users into running malicious code How it works? Self-XSS is a social engineering attack used to gain control of victims' web accounts by tricking users into copying and pasting malicious content into their browsers. Since Web browser vendors a...

Brazil's Biggest Cosmetic Brand Natura Exposes Personal Details of Its Users

Brazil's biggest cosmetics company Natura accidentally left hundreds of gigabytes of its customers' personal and payment-related information publicly accessible online that could have been accessed by anyone without authentication. SafetyDetective researcher Anurag Sen last month discovered two...

CVE-2020-8434

Jenzabar JICS aka Internet Campus Solution before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode ...

CVE-2020-8434

Jenzabar JICS aka Internet Campus Solution before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode ...

Hardcoded credentials

Jenzabar JICS aka Internet Campus Solution before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode ...

CVE-2020-8434

Jenzabar JICS (Internet Campus Solution) is affected by CVE-2020-8434 in versions prior to 9.0.1 Patch 3, 9.1 prior to 9.1.2 Patch 2, and 9.2 prior to 9.2.2 Patch 8. The issue is that session cookies are derived from the username via a PBKDF-based scheme and AES, with a hard-coded password used t...

CVE-2020-8434

Jenzabar JICS aka Internet Campus Solution before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode ...

XSS vulnerability in kkcms

kkcms is an open source video capture and playback system. kkcms has an XSS vulnerability that can be exploited by attackers to obtain user cookie information...

Component com_hotel cross-site scripting vulnerability in Joomla!

Joomla! is an open source, cross-platform content management system CMS developed using PHP and MySQL. A cross-site scripting vulnerability exists in the Joomla! component comhotel. An attacker can exploit the vulnerability to obtain sensitive information such as user cookies...

Stored Cross-Site Scripting Vulnerability in Swordfish Forum Ca***.php File

Swordfish Forum is a bbs forum system officially and publicly released by Catfish CMS, Swordfish Forum program is a completely open source and free forum source code, it is a lightweight and fast php forum source code. Swordfish Forum Ca.php file has a stored cross-site scripting vulnerability...

Storage-based cross-site scripting vulnerability exists in the background of enterprise website building system of Zibo Shining Network Technology Co.

Zibo Shining Network Technology Co., Ltd. enterprise station-building system a specialized enterprise station-building solutions for the product. There is a stored cross-site scripting vulnerability in the background of Zibo Shining Network Technology Co. Attackers can use the vulnerability to...

XSS Vulnerability in EyouCMS

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework as the core development. EyouCms XSS vulnerability , attackers can use the vulnerability to obtain sensitive information such as administrator cookies...

Topcoder: Post Based Reflected XSS on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action

Summary: Hi : A post based reflected XSS occurs when creating bookmarks. Steps To Reproduce: Title and Labels parameters are vulnerable to XSS on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action. This form uses POST request so i added HTML file below. When someone...

Topcoder: Stored XSS on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action

Summary: Hi : Adding javascript url causes to stored XSS when creating bookmark. Steps To Reproduce: Go to https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action . Write javascript:alertdocument.domain on url input and fill other areas. After create, go...

openSUSE Security Update : webkit2gtk3 (openSUSE-2020-602)

This update for webkit2gtk3 to version 2.28.1 fixes the following issues : Security issues fixed : - CVE-2020-10018: Fixed a denial of service because the mdeferredFocusedNodeChange data structure was mishandled bsc1165528. - CVE-2020-11793: Fixed a potential arbitrary code execution caused by a...

openSUSE: Security Advisory for webkit2gtk3 (openSUSE-SU-2020:0602-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...