RSA Authentication Agent (IIS) < 8.0.2 Multiple Vulnerabilities

RSA Authentication Agent for IIS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Sharepoint 14.x Cross Site Scripting

Title: Microsoft-sharepoint FilterValue Cross Site Scripting XSS + Date: 2018/04/04 + Author: Mostafa Gharzi + Team: Maher - CertCC.ir + Vendor Homepage: https://products.office.com/en-us/sharepoint/collaboration + Tested on: Windows 10 & Kali Linux + Versions: 14.x and Before + Vulnerable...

Catfish CMS suffers from cross-site scripting vulnerability

Catfish Catfish CMS is an open source PHP content management system. A cross-site scripting vulnerability exists in Catfish CMS. An attacker can exploit this vulnerability to obtain cookie information about other users and administrators...

CVE-2018-1232

RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur when handling certain malicious web cookies that have invalid formats. The attacker could exploit this vulnerability to crash the...

Stack overflow

RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur when handling certain malicious web cookies that have invalid formats. The attacker could exploit this vulnerability to crash the...

Brave Software: Cross domain tracking even with 3rd party cookies disabled.

Cross domain tracking Default settings from Brave browser has 3rd party cookies disabled. Which I am assuming also disables 3rd part storage like IndexedDB etc. Because of this protection it is not possible for a 3rd party to track users across multiple domains. But, Even though third-party cooki...

ServiceNow ITSM Cross-Site Scripting Vulnerability

ServiceNow ITSM is an IT service management system. The system features incident management, problem management, asset and cost management. A cross-site scripting vulnerability exists in ServiceNow ITSM version 2016-06-02. A remote attacker can exploit the vulnerability to obtain cookies for othe...

SQL Injection and Cross-Site Scripting Vulnerabilities in Esmay's Non-Book Resource Management System

Esmay Non-Book Resource Management System can help librarians conveniently manage accompanying books, accompanying CD-ROMs and other non-paper resources, and help patrons directly search, browse online, operate online, partially download, and fully download the CD-ROMs they need. There are SQL...

Arbitrary User Password Reset and Reflective Cross-site Scripting Vulnerabilities in zzcms System

Webmaster Merchants Content Management System ZZCMS developed by the ZZCMS team, into the database optimization, content caching, AJAX and other technologies, open source, independent functional modules, to facilitate secondary development. zzcms system exists arbitrary user password reset and...

The vulnerability of the Linux operating system’s TCP stack allows a hacker to induce a service failure.

The vulnerability of the Linux operating system’s TCP stack exists due to errors in the SYN cookie mechanism. Exploiting this vulnerability allows a remote attacker to cause a service failure resulting in increased computational resources usage through the use of specially crafted SYN packets...

PCI DSS v3.2 & Exposing Session ID in URL

Passing the session ID in the URL such as QID 150068 “Session ID in URL” will be marked as a Fail for PCI as of April 15, 2018 in accordance with PCI DSS v3.2. QID 150068 is a PCI Fail according to PCI DSS v3.2 Requirement 6.5.10: 6.5.10 Examine software development policies and procedures and...

arrimobel.com XSS vulnerability

Open Bug Bounty ID: OBB-578932 Description| Value ---|--- Affected Website:| arrimobel.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

LocalTapiola: Reflected XSS (myynti.lahitapiolarahoitus.fi)

Basic report information Summary: There is an Reflected XSS on myynti.lahitapiolarahoitus.fi. Description: There is an Reflected XSS on myynti.lahitapiolarahoitus.fi website. redirect parameter is vulnerable to XSS. Impact: Steals cookies from other logged in users. Browsers / Apps Verified In:...

CVE-2018-6527

XSS vulnerability in htdocs/webinc/js/advparentctrlmap.php in D-Link DIR-868L DIR868LA1FW112b04 and previous versions, DIR-865L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and previous versions allows remote attackers to read a cookie via a crafted...

CVE-2018-6528

XSS vulnerability in htdocs/webinc/body/bscsmssend.php in D-Link DIR-868L DIR868LA1FW112b04 and previous versions, DIR-865L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and previous versions allows remote attackers to read a cookie via a crafted receiver...

CVE-2018-5455

A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter to consist of only digits, allowing an attacker to perform a brute force attack bypassing...

CVE-2018-5455

A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter to consist of only digits, allowing an attacker to perform a brute force attack bypassing...

Authentication flaw

A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter to consist of only digits, allowing an attacker to perform a brute force attack bypassing...

CVE-2018-5455

A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter to consist of only digits, allowing an attacker to perform a brute force attack bypassing...

Insecure Logout

intercom-rails is vulnerable to insecure logouts. The library does not delete cookies on a user logging out, meaning that users aren't properly signed out, allowing a malicious user to access the system as a different user...