WordPress PayPal Checkout Payment Gateway 1.6.8 Plugin - Parameter Tampering Vulnerability

Exploit for php platform in category web applications WordPress PayPal Checkout Payment Gateway 1.6.8 Plugin - Parameter Tampering Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter...

Jfinal cms xss vulnerability at frontend feedback

Jfinal cms uses JFinal as a web framework , template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Support for multi-site , oauth2 authentication , account registration , password encryption , comments and replies , message alerts , site visits...

xss vulnerability in in***.php page of LaySNS lightweight content community system of Wuhan Classen Technology

LaySNS is a lightweight, integrated content management and community interaction website management system based on ThinkPHP+Layui architecture. An xss vulnerability exists in the in.php page of Wuhan Classen Technology's LaySNS lightweight content community system, which stems from the program n...

Jfinal cms xss vulnerability in frontend registry

Jfinal cms uses JFinal as a web framework , template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Support for multi-site , oauth2 authentication , account registration , password encryption , comments and replies , message alerts , site visits...

openSUSE Security Update : webkit2gtk3 (openSUSE-2019-566)

This update for webkit2gtk3 to version 2.20.3 fixes the following issues : These security issues were fixed : - CVE-2018-4190: An unspecified issue allowed remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch bsc1097693. - CVE-2018-4199: An...

Webtech - Identify Technologies Used On Websites

Identify technologies used on websites. More info on the release's blogpost. CLI Installation WebTech is available on pip: pip install webtech It can be also installed via setup.py: python setup.py install --user Burp Integration Download Jython 2.7.0 standalone and install it into Burp. In...

Knight Talent System has xss vulnerability

Knight Talent System is based on PHP + MYSQL as the core development of a set of free + open source professional recruitment system. Knight Talent System suffers from a cross-site scripting vulnerability. An attacker can use this vulnerability to embed malicious code in a web page to obtain users...

Microsoft Edge and Microsoft Internet Explorer Security Bypass Vulnerability

Microsoft Edge and Microsoft Internet Explorer IE are both products of Microsoft Corporation.Microsoft Edge is a web browser that comes with Windows 10 and later.Microsoft Internet Explorer is a web browser that comes with Windows operating systems. Microsoft Edge is a web browser that comes with...

ESPCMS P8 Me***.php page has xss vulnerability

ESPCMS is an enterprise website management system built on LAMP development. An xss vulnerability exists in the ESPCMS P8 Me.php page. Attackers can use the vulnerability to obtain cookie access when logging into the background as an administrator...

ESPCMS P8 Me***.php page has xss vulnerability

ESPCMS is an enterprise website management system built on LAMP development. An xss vulnerability exists in the ESPCMS P8 Me.php page. Attackers can use the vulnerability to obtain cookie access when logging into the background as an administrator...

ALPINE-CVE-2019-9636

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding with an incorrect netloc during NFKC normalization. The impact is: Information disclosure credentials, cookies, etc. that are cached against a given hostname. The components are:...

Information disclosure

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding with an incorrect netloc during NFKC normalization. The impact is: Information disclosure credentials, cookies, etc. that are cached against a given hostname. The components are:...

ALE Alcatel OmniAccess Wireless Access Point Cross-Site Scripting Vulnerability

The ALE Alcatel OmniAccess Wireless Access Point is a wireless access point device from ALE France. A cross-site scripting vulnerability exists in the ALE Alcatel OmniAccess Wireless Access Pointh. A remote attacker can exploit this vulnerability by tricking an IAP administrator into clicking on ...

pfSense cross-site scripting vulnerability (CNVD-2019-06173)

pfsense is an open source routing and firewall products , based on freebsd system customization and development . pfSense has a cross-site scripting vulnerability. Attackers can use the vulnerability through the construction of XSS statements , pop-up box operation , access to user cookies and...

Future Proofing Your Content Security Perimeter with Enhanced Token Authentication

Background: Media Content Security Security in the media & entertainment industry means securing the entire content consumption path. For any OTT or streaming company that wants to serve or distribute its content to end users, has to protect and safeguard their content against an ever-evolving...

Semmle: the login blocking mechanism does not work correctly

Summary: The login block mechanism does not work correctly because it blocks the login for 1 minute and allows you to sign in again many times with specific pattern by allowing login 2 or 3 times after 1 minute Exploitation 1. open https://lgtm-com.pentesting.semmle.net/ 2. try to login with vali...

Arbitrary file download vulnerability in s-cms news portal system do***.php page

An arbitrary file download vulnerability exists in the do.php page of the s-cms news portal system, which allows an attacker to forge cookies to bypass authentication and download files at will...

CVE-2018-12402

The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resource...

CVE-2018-12402

The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resource...

Design/Logic Flaw

The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resource...