One Kebba cms V2.0 has xss vulnerability

OneCapaCms is a small business building system based on thinkphp 5.0. One Keba cms V2.0 has an xss vulnerability that can be exploited by attackers to obtain administrator cookies...

xss vulnerability in uke365 website category navigation system v1.3.4fe***.html page

Uc365 website classification navigation system is a navigation management system based on PHP + MYSQL development and construction. An xss vulnerability exists in the Uke365 Website Classifieds Navigation System v1.3.4fe.html page, which can be exploited by an attacker to obtain administrator...

UX365 website category navigation system v1.3.4we***.php file has xss vulnerability

Uc365 website classification navigation system is a navigation management system based on PHP + MYSQL development and construction. An xss vulnerability exists in the file we.php in the Uke365 website category navigation system v1.3.4, which can be exploited by an attacker to obtain administrator...

xss vulnerability in uke365 website category navigation system v1.3.4ad***.html page

Uc365 website classification navigation system is a navigation management system based on PHP + MYSQL development and construction. An xss vulnerability exists in the v1.3.4ad.html page of the Uke365 website category navigation system, which can be exploited by an attacker to obtain administrator...

Rabbit Movie CMS has xss vulnerability

Rabbit TV CMS is an open source content building system. A cross-site scripting vulnerability exists in Rabbit Movie CMS. Attackers can use this vulnerability to embed malicious code in web pages to obtain users' personal information or steal administrator cookie information...

Rabbit Movie CMS has xss vulnerability

Rabbit TV CMS is an open source content building system. A cross-site scripting vulnerability exists in Rabbit Movie CMS. Attackers can use this vulnerability to embed malicious code in web pages to obtain users' personal information or steal administrator cookie information...

Session Fixation

pcsd in pcs is vulnerable to Session Fixation. Failing to validate cookies on the server side when a user is logged out, could potentially allow an attacker to perform session fixation attacks on pcsd in order to impersonate another user...

TomTom: Reflected XSS on www.tomtom.com

Summary: XSS on www.tomtom.com is very dangerous, if this vulnerability misused by Attacker to steal cookie it will be fatal for other users. Proof of Concept: - I tried to visit https://www.tomtom.com/enau/search/ - Then, search using keyword: TEST" - I realized double quote " is reflected - So,...

python: Information Disclosure due to urlsplit improper NFKC normalization

It was discovered that python's functions urllib.parse.urlsplit and urllib.parse.urlparse do not properly handle URLs encoded with Punycode/Internationalizing Domain Names in Applications IDNA, which may result in a wrong domain name specifically the netloc component of URL - user@domain:port bei...

ScanQLi - Scanner To Detect SQL Injection Vulnerabilities

ScanQLi is a simple SQL injection scanner with somes additionals features. This tool can't exploit the SQLi, it just detect them. Tested onDebian 9 Features Classic Blind Time based GBK soon Recursive scan follow all hrefs of the scanned web site Cookies integration Adjustable wait delay between...

TPCMF has an xss vulnerability

TPCMF is a content management framework developed based on PHPCMF. TPCMF has an xss vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

CVE-2019-3868

Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...

keycloak: session hijack using the user access token

Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...

keycloak: session hijack using the user access token

Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...

Multiple VPN applications insecurely store session cookies

The Missing Encryption Of Sensitive Data vulnerability in FortiClient may allow an attacker to access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only if endpoint device has been compromised in such a way that the attacker has access to...

WordPress Download Manager Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Download Manager. An attacker can insert malicious js code into the...

CVE-2019-11084

GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies...

Cross site scripting

GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies...

CVE-2019-11084

CVE-2019-11084 concerns GAuth 0.9.9 beta, with a stored XSS vulnerability that causes a popup to appear repeatedly and discloses cookies. The available connected sources identify the issue as a stored cross-site scripting flaw affecting GAuth 0.9.9 beta, but do not provide further product version...

CVE-2019-11084

GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies...