Stored XSS Vulnerability in zzcms v8.2

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. There is a stored xss vulnerability in ZZCMS version 8.2, through which an attacker can steal administrator cookie information, combined with csrf to operate the backend and so on...

Ed: Session Cookie Without Secure Flag,

Assigned to:-ED Assigned by:- Kirtikumar Anandrao Ramchandani Assigned on:- 25/04/2018 Bug overview:- Session Cookie without secure flag. Cookie Name:- gitlabsession Description:-Risk description: Since the Secure flag is not set on the cookie, the browser will send it over an unencrypted channel...

Zyxel ZyWALL ZLD 4.30 Cross Site Scripting Vulnerability

Exploit for hardware platform in category web applications ======================================================================= title: Reflected Cross-Site Scripting product: Zyxel ZyWALL: see "Vulnerable / tested version" vulnerable version: ZLD 4.30 and before fixed version: ZLD 4.31 CVE...

CVE-2018-10221

An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tagtag parameter to the index.php?m=tags&f=index&v=add&&su=wuzhicms URI. After a website editor whose privilege is lower than the administrator logs in, he can add...

Cross site scripting

An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tagtag parameter to the index.php?m=tags&f=index&v=add&&su=wuzhicms URI. After a website editor whose privilege is lower than the administrator logs in, he can add...

CVE-2018-10221

An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tagtag parameter to the index.php?m=tags&f=index&v=add&&su=wuzhicms URI. After a website editor whose privilege is lower than the administrator logs in, he can add...

CVE-2018-10221

WUZHI CMS V4.1.0 contains a persistent XSS vulnerability in the tag[tag] parameter of index.php?m=tags&f=index&v=add&_su=wuzhicms. An authenticated user with lower privilege (e.g., site editor) can inject a payload to steal administrator cookies after logging in. Connected sources (CNVD-2018-0938...

CVE-2018-10221

An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tagtag parameter to the index.php?m=tags&f=index&v=add&&su=wuzhicms URI. After a website editor whose privilege is lower than the administrator logs in, he can add...

Session Fixation

ec-cube/ec-cube is vulnerable to session fixation attacks. The vulnerability exists due to the lack of renewal of session cookies, allowing attackers to impersonate an authenticated user...

Design/Logic Flaw

An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each...

CVE-2018-10189

An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each...

CVE-2018-10189

In Mautic 1.x and 2.x before 2.13.0, an attacker can systematically emulate tracking cookies per contact by manipulating the cookie value with +1, effectively allowing a third party to assume the tracked identity of other contacts and access information via forms using progressive profiling. This...

D-Link DIR-815 Cross-Site Scripting Vulnerability (CNVD-2018-08947)

D-Link DIR-815 REV.B is a wireless router product from AUO D-Link. A cross-site scripting vulnerability exists in the D-Link DIR-815 REV. B using firmware DIR-815REVBFIRMWAREPATCH2.07.B01 and prior versions. A remote attacker can exploit this vulnerability by sending the 'RESULT' parameter to the...

D-Link DIR-815 Cross-Site Scripting Vulnerability

D-Link DIR-815 REV.B is a wireless router product from AUO D-Link. A cross-site scripting vulnerability exists in the D-Link DIR-815 REV. B using firmware DIR-815REVBFIRMWAREPATCH2.07.B01 and prior versions. A remote attacker can exploit this vulnerability by sending the 'Treturn' parameter to th...

CVE-2014-8422

The CVE-2014-8422 entry affects Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices prior to R3.32.0, where the web-based management (WBM) interface generates session cookies with insufficient entropy, enabling remote attackers to hijack sessions via brute-force. The provi...

RSA Authentication Agent (IIS) < 8.0.2 Multiple Vulnerabilities

RSA Authentication Agent for IIS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Sharepoint 14.x Cross Site Scripting

Title: Microsoft-sharepoint FilterValue Cross Site Scripting XSS + Date: 2018/04/04 + Author: Mostafa Gharzi + Team: Maher - CertCC.ir + Vendor Homepage: https://products.office.com/en-us/sharepoint/collaboration + Tested on: Windows 10 & Kali Linux + Versions: 14.x and Before + Vulnerable...

Catfish CMS suffers from cross-site scripting vulnerability

Catfish Catfish CMS is an open source PHP content management system. A cross-site scripting vulnerability exists in Catfish CMS. An attacker can exploit this vulnerability to obtain cookie information about other users and administrators...

CVE-2018-1232

RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur when handling certain malicious web cookies that have invalid formats. The attacker could exploit this vulnerability to crash the...

Stack overflow

RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur when handling certain malicious web cookies that have invalid formats. The attacker could exploit this vulnerability to crash the...