Cross-Site Scripting Vulnerability in SyGuestBook

SyGuestBook is a multifunctional message board system that continues to be developed with php+MySQL. SyGuestBook version 1.1 suffers from a cross-site scripting vulnerability, which is caused by the program's failure to effectively filter user-submitted data. An attacker can exploit the...

[SECURITY] Fedora 27 Update: curl-7.55.1-8.fc27

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] Fedora 26 Update: curl-7.53.1-13.fc26

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Needl - Take Back Your Privacy. Lose Yourself In The Haystack.

Take back your privacy. Lose yourself in the haystack. Your ISP is most likely tracking your browsing habits and selling them to marketing agencies albeit anonymised. Or worse, making your browsing history available to law enforcement at the hint of a Subpoena. Needl will generate random Internet...

XSS Vulnerability in Oceanis Cloud Browser

Oceanis Cloud Browser is a cross-platform cloud service browser with a dual-core engine developed by Maxthon. An XSS vulnerability exists in Oceanis Cloud Browser, which can be exploited by attackers to implant cross-site code and obtain sensitive information such as user cookies...

Razer US: Authenticated DOM-based XSS in deals.razerzone.com via the rurl parameter.

The researcher discovered that deals.razerzone.com was vulnerable to Authenticated DOM-based XSS via the rurl parameter, which could allow account hijacking via session cookies. The researcher identified the specific code snippet and provided two PoCs with different techniques. Another great repo...

CVE-2017-13702

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. Cookies can be stolen, manipulated, and reused...

CVE-2017-13702

CVE-2017-13702 affects MOXA EDS-G512E (5.1 build 16072215). The connected sources describe an information/cookie management flaw where cookies can be stolen, manipulated, and reused via the device. Exploitation context is via network exposure, but the documents do not provide exploit details, exp...

Microsoft ASP.NET Core Elevation of Privilege Vulnerability (CNVD-2017-37114)

Microsoft ASP.NET Core is a cross-platform open source framework from Microsoft. The framework is used to build cloud-based applications such as Web One applications, IoT applications, and mobile backends. A privilege extraction vulnerability exists in Microsoft ASP.NET Core version 2.0. A remote...

CVE-2017-11879

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

CVE-2017-11879

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

Privilege escalation

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

CVE-2017-11879

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

UBUNTU-CVE-2017-7837

SVG loaded through "" tags can use "" tags within the SVG data to set cookies for that page. This vulnerability affects Firefox 57...

Cross-Site Scripting Vulnerability in eYou Email System

eYou email system is a mail system software with independent intellectual property rights, which is independently researched and developed by EYou. As a mail system software and overall solution provider in China, EYou email system provides a professional technology platform and complete network...

auxblogcms 1.0.6 Cross-Site Scripting Vulnerability

auxblogcms is a php personal blog system based on PHP+MySQL program. A cross-site scripting vulnerability exists in auxblogcms version 1.0.6, which is caused by the system failing to effectively filter user-submitted data. An attacker can exploit this vulnerability to insert cross-site code and...

[SECURITY] Fedora 27 Update: curl-7.55.1-6.fc27

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

MyBB 1.8.13 - Cross-Site Scripting

MyBB 1.8.13 - Cross-Site Scripting Exploit Title: XSS in MyBB up to 1.8.13 via installer Date: Found on 05-29-2017 Exploit Author: Pablo Sacristan Vendor Homepage: https://mybb.com/ Version: Version 1.8.13 Fixed in 1.8.13 CVE : CVE-2017-16781 No HTML escaping when returning an $error in...

MyBB 1.8.13 - Cross-Site Scripting

Exploit Title: XSS in MyBB up to 1.8.13 via installer Date: Found on 05-29-2017 Exploit Author: Pablo Sacristan Vendor Homepage: https://mybb.com/ Version: Version 1.8.13 Fixed in 1.8.13 CVE : CVE-2017-16781 No HTML escaping when returning an $error in /install/index.php can lead to an XSS which...

Cross-site Scripting Vulnerability in Tonglian Da3 Collaboration Office Platform

Tonglian Da3 cooperative office platform is a series of Da3 management software products provided by Tonglian for governmental units at all levels, focusing on "mobile government office". There is a cross-site scripting vulnerability in the Da3 collaborative office platform, which can be exploite...