Multiple vulnerabilities in jspxcms

jspxcms is an open source content management system based on java and jsp technology . jspxcms cross-site request forgery and reflective cross-site scripting vulnerabilities. Attackers can use the vulnerability to send scripts containing malicious links , to be reviewed by the administrator can b...

DataLife Engine 13.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications + Title: DataLife Engine Core Cross Site Scripting XSS & Execution Code + Author: Mostafa Gharzi + Team: Maher - CertCC.ir + Vendor Homepage: www.dleviet.com www.dle-news.com + Tested on: Windows 10 & Kali Linux + Versions: 13.0 and Before +...

Advanced Man in the Middle Attack Framework: Evilginx

Evilginx is an attack framework for setting up phishing pages. Instead of serving templates of sign-in pages lookalikes, Evilginx becomes a relay between the real website and the phished user . Phished user interacts with the real website, while Evilginx captures all the data being transmitted...

Information disclosure

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure...

CVE-2016-8623

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure...

CVE-2016-8615

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar...

CVE-2016-8623

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure...

CVE-2016-8623

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure...

Grammarly: Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's origin

Summary: Attacker could trigger Grammarly extension's gnar.fetch command using a crafted page to perform XHR with cookies and any configurational params to any cross-origin resource. Description: Page could Init Grammarly popup editor no user gesture, helper Events have isTrusted property, which...

CFNetwork Remote Vulnerability in Multiple Apple Products

Apple iTunes for Windows and others are products of Apple Inc. in the United States.Apple iCloud for Windows is a cloud service based on the Windows platform that supports storage of music, photos, apps, contacts, etc. iTunes for Windows is a suite of Windows-based media player...

DataLife Engine 13.0 Cross Site Scripting

Title: DataLife Engine Core Cross Site Scripting XSS & Execution Code + Date: 2018/08/02 + Author: Mostafa Gharzi + Team: Maher - CertCC.ir + Vendor Homepage: www.dleviet.com www.dle-news.com + Tested on: Windows 10 & Kali Linux + Versions: 13.0 and Before + Vulnerable Parameter: Post Method +...

WAScan v0.2.1 - Web Application Scanner

WAScan Web Application Scanner is a Open Source web application security scanner. It is designed to find various vulnerabilities using "black-box" method, that means it won't study the source code of web applications but will work like a fuzzer, scanning the pages of the deployed web application,...

CVE-2017-2589

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...

CVE-2017-2589

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...

CVE-2017-2589

The vulnerability CVE-2017-2589 affects hawtio servlet 1.4, where a single HttpClient instance proxies requests with a persistent cookie store, causing cookies to be stored locally and shared across all proxy clients. As a result, all users of the proxy share the same cookies, potentially exposin...

Fedora 27 : qutebrowser (2018-35325c9faf)

This update fix CVE-2018-10895 0 and a few minor bugs. 0 : Due to a CSRF vulnerability affecting the qute://settings page, it was possible for websites to modify qutebrowser settings. Via settings like editor.command, this possibly allowed websites to execute arbitrary code. ---- This version fix...

Hindsight - Internet History Forensics For Google Chrome/Chromium

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications with more to come!. Hindsight can parse a number of different types of web artifacts, including URLs, download...

CVE-2018-12429

JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie...

Insecure Cookies

noVNC did not provide support for secure cookies in an HTTPS session. This causes browsers to send session cookies in an insecure HTTP channel. An attacker who is able to intercept traffic will be able to capture cookie information and access the application on behalf of the user...

Use-After-free Vulnerability

libcurl.so is vulnerable to use after-free vulnerability. The attack is possible when cookies are shared among many easy handles simultaneously used in different threads...