9511 matches found
CVE-2016-6545
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password...
CVE-2016-6545 iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password...
The vulnerability of the Mozilla Firefox browser, related to errors in the implementation of cookie storage mechanisms, allows a hacker to access cookies with the `HttpOnly` attribute.
The vulnerability of the Mozilla Firefox browser is related to errors in the implementation of cookie storage mechanisms. Exploiting this vulnerability can allow a malicious actor, operating remotely, to access cookies with the HttpOnly attribute through a crafted HTTP request...
XSS Vulnerability in Atlassian Confluence
Confluence is a professional enterprise knowledge management and collaboration software that can also be used to build enterprise wikis. Confluence has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...
DEBIAN-CVE-2018-12910
The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname...
CVE-2018-12910
The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname...
efucms website builder system has cross-site scripting vulnerability
efucms is an easy-to-use content management system based on ThinkPHP. There is an xss vulnerability in efucms website builder system, which can be exploited by attackers to steal administrator cookies and fake administrator privilege login...
U.S. Dept Of Defense: █████ - DOM-based XSS
Greetings, I've discovered a DOM-based XSS at ███ Proof of concept: 1. Go to https://████/█████████/home/troubleshoot.html?lang=en 2. In the username field, add the following code: --button/autofocus/onfocus=Function"confirm1";//name="XSS 3. The javascript code is correctly executed: ██████ Impac...
CVE-2018-12910
An out-of-bounds read has been discovered in libsoup when getting cookies from a URI with empty hostname. An attacker may use this flaw to cause a crash in the application...
Ranzhi Synergy is vulnerable to XSS
Ranch Collaboration System is an open source collaborative office system for small and medium-sized businesses. Ranzhi Synergy has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...
Default credentials
Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to access a user's password in cleartext...
CVE-2018-11639
Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to access a user's password in cleartext...
CVE-2018-11639
Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to access a user's password in cleartext...
CVE-2018-11639
Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to access a user's password in cleartext...
U.S. Dept Of Defense: █████ - DOM-based XSS
Greetings, I've discovered a DOM-based XSS at ██████ Proof of concept: 1. Go to https://███/█████/home/troubleshoot.html?lang=en&returnUrl=https://█████/███████/home/signin.html?returnUrl=https%3A//████/██████████/home/user.html 2. In the username field, add the following code:...
Mozilla Firefox Security Restriction Bypass Vulnerability (CNVD-2018-14988)
Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 61, which stems from the program's failure to detect protection for SameSite cookies. An attacker could use this vulnerabilit...
Firewall and Privatizing Proxy: macOS Fortress
macOS-Fortress is a Firewall, Blackhole, and Privatizing Proxy for Trackers, Attackers, Malware, Adware, and Spammers. It is Kernel-level, OS-level, and client-level security for macOS. Built to address a steady stream of attacks visible on snort and server logs, as well as blocks ads, malicious...
Hanno's projects: Reflected xss in Serendipity's /index.php
Summary: There exists a reflected xss threat in https://blog.fuzzing-project.org/index.php?frontpage. Description: By setting the serendipity%5bmultiCat%5d%5b%5d POST input to 1'"&%prompt1 I'm able to trigger a JavaScript prompt box in versions of IE up to and including IE 11. Steps To Reproduce:...
Hanno's projects: Reflected Cross-Site Scripting in Serendipity (serendipity.SetCookie)
Summary The Smarty template responsible of creating JavaScript snippets assigning cookies to users is during sorting of entries in the administration interface is affected by a reflected cross-site scripting. Description In templates/2k11/admin/entries.inc.tpl, the following code is dynamically...