XYCMS message board PHP version of the processing message function has XSS vulnerabilities

XYCMS message board is a php+MySQL php message board source code, the software for the ordinary message board can be widely used in corporate websites and other sites that require message boards for use. XYCMS message board PHP version to deal with the message function there are XSS...

Gratipay: self cross site scripting

Vulnerability Exploited : cross site scripting using csrf Vulnerable URL:https://gratipay.com/search Vulnerability Explanation :The application is vulnerable with Reflected Cross Site Scripting. Here application fails to validate user supplied inputs due to which an attacker can inject his own...

Elastic Kibana Multiple Vulnerabilities (Jul 2017)

Elastic Kibana is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elastic:kibana"; ifdescripti...

WakaTime: Session not expired on logout

Description: Session management issue in https://wakatime.com Cookies are used to maintain session of the particular user and they should expire once the user logs out of his account.In secure web application,Cookies immediately expire once the user logs out of his account. But this is not...

WakaTime: Session Not Expired On Logout

Hi Wakatime Security Team, There is a session management vulnerability in your website. i.e. user's session is not expiring immediately after the logout. You can get more information of the vulnerability here -...

XSS Vulnerability in WeiPHP, an Open Source WeChat Public Platform Development Framework

WeiPHP is an easy to build, scalable open source WeChat public platform development framework, you can easily build a belong to their own WeChat public account operation platform. Open source WeChat public platform development framework WeiPHP index.php in the root directory exists an xss...

Microsoft Dynamic CRM 2016 Cross Site Scripting

Product: MS Dynamic CRM 2016 Vendor: Microsoft Vulnerability type: Cross Site Scripting Vulnerable version: MS Dynamic CRM 2016 SP1 and previous Vulnerable component: SyncFilterPage.aspx Report confidence: Confirmed Solution status: Not fixed by Vendor, will not patch the vuln. Fixed versions: -...

Word Diary App Has Multiple Vulnerabilities

Word Diary App is a word memorization app with situational semantics and English-English explanations. Word Diary APP has arbitrary user registration, arbitrary password reset and stored cross-site scripting attack vulnerabilities, which can be exploited by attackers to register any user,...

PHPMailer Cross-Site Scripting Vulnerability

PHPMailer is a package of PHP functions for sending e-mail . A cross-site scripting vulnerability exists in PHPMailer. An attacker can exploit this vulnerability to obtain user login cookie information...

XSS Vulnerability in Shenzhen Siliconware Sewise VOD Server System

wise on-demand server software is server-side distribution software that provides streaming playback of audio and video files. There is an XSS vulnerability in sewise VOD server system of Shenzhen Siliconware Technology. An attacker can exploit the vulnerability to obtain sensitive information su...

Fortinet FortiOS Cross-Site Scripting Vulnerability (CNVD-2017-11805)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet company dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. A cross-site...

CVE-2016-1000219

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield...

Authorization

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield...

CVE-2016-1000219

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield...

CVE-2016-1000219

CVE-2016-1000219 affects Kibana prior to 4.5.4 and 4.1.11. When a custom output is configured for logging in, cookies and authorization headers could be written to Kibana log files, enabling a local attacker to hijack sessions of other users in environments using authentication like Shield. The p...

Session Information Disclosure

github.com/grafana/grafana is vulnerable to session information disclosure. Cookies are not generated with the secure flag, this allows malicious actors to steal login session information over insecure connections...

XSS vulnerability in ourphp

OURPHP is a PHP+MySQL based development of W3C standard building system. There is an xss vulnerability in OurPHP member center, which can be exploited by attackers to obtain administrator cookies...

9Cookies Driver - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application 9Cookies Driver published at the 'play' market has multiple vulnerabilities...

CVE-2017-1319

IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session SSL cookie. IBM X-Force ID: 125731...

Reflective Cross-site Scripting Vulnerability in ESPCMS Enterprise Web Management System V6.7.17.04.05

ESPCMS enterprise website management system is based on LAMP development and construction of enterprise website management system. A reflective cross-site scripting vulnerability exists in the search box of the ESPCMS enterprise website management system. The vulnerability allows attackers to...