CVE-2015-3801

CVE-2015-3801 affects Apple iOS WebKit’s CFNetwork Cookies: the document.cookie API could be used to bypass a single-cookie restriction in WebKit’s cookie handling, prior to iOS 9. The issue originates in CFNetwork Cookies (WebKit) and is exploitable via unspecified vectors over the network. The ...

CVE-2015-5885

The CFNetwork Cookies component in Apple iOS before 9 allows remote attackers to track users via vectors involving a cookie for a top-level domain...

CVE-2015-5885

The CVE-2015-5885 issue affects the CFNetwork Cookies handling in Apple platforms (notably iOS before 9 and macOS in related advisories). The vulnerability description indicates a cross-domain cookie handling flaw that allowed an attacker in a privileged or network position to track a user’s acti...

Microsoft SharePoint Foundation Cross-Site Scripting Vulnerability (CNVD-2015-05988)

Microsoft SharePoint Foundation is the United States Microsoft Microsoft company's set of Web-based collaboration platform for small organizations or departments. A cross-site scripting vulnerability exists in the Microsoft SharePoint Foundation 2013 SP1 version that can be exploited by a remote...

Django arbitrary code execution vulnerability analysis-vulnerability warning-the black bar safety net

From Django SECTETKEY to code execution Django is a can be used to quickly build high-performance, elegant web platform by Python. The use of the MVC software design pattern, namely the model M, view V and the controller C. It was originally being developed for the management of the Lawrence...

eBay Fixes XSS Flaw in Subdomain

There was a cross-site scripting vulnerability in an eBay domain that could have allowed an attacker to steal users’ session cookies and take over their accounts. The company has removed the vulnerable page, according to the researcher who discovered the bug and disclosed it to eBay, Aditya Sood...

Amazon Linux: Security Advisory (ALAS-2014-407)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2015-514)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PayPal - Mobile Security Approval Auth Bypass Vulnerability

Document Title: =============== PayPal - Mobile Security Approval Auth Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1485 Video: https://www.youtube.com/watch?v=Gzq8TD2Co9Y Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1486 Release...

ownCloud: apps.owncloud.com: Potential XSS

@alaarfaoui reported an issue potentially leading to a XSS vulnerability when an attacker is able to intercept and modify unencrypted HTTP requests. As of request by the reporter this issue has been only disclosed limited. Potential XSS Vulnerability was found. Able to steal the victim's session...

Tendoo CMS 1.3 - XSS Vulnerabilities

Introduction :a Stored And a Reflected XSS Vulnerability In Profile Area In Tendoo CMSMake CMS Vulnerable And Can Be Used For Stealing Admin Cookies And ....... . Stored Xss In http://localhost/tendoo/index.php/account/update In FirstName and Last Name InputsExcute Java Script Codes And If Admin ...

Web Application Cookies Not Marked HttpOnly

The remote web application sets various cookies throughout a user's unauthenticated and authenticated session. However, one or more of those cookies are not marked 'HttpOnly', meaning that a malicious client-side script, such as JavaScript, could read them. The HttpOnly flag is a security mechani...

Web Application Cookies Not Marked Secure

The remote web application sets various cookies throughout a user's unauthenticated and authenticated session. However, there are instances where the application is running over unencrypted HTTP or the cookies are not marked 'secure', meaning the browser could send them back over an unencrypted...

ownCloud: apps.owncloud.com: Session Cookie in URL can be captured by hackers

Session Cookie in URL URL: https://apps.owncloud.com/stories/feed+rss Issue detail The URL in the request appears to contain a PHP Session token within the query string: https://apps.owncloud.com/stories/feed+rss?id=42590&PHPSESSID=ee0624300266683a4625aabea344212a Issue background Sensitive...

Mail.ru: [start.icq.com] Reflected XSS via Cookies

Request: GET / HTTP/1.1 Cookie: geo=380; icqsrchlang=ua; abt=1"alertdocument.domain alertdocument.domain alertdocument.domain ICQ Mobile...

帝友P2P借贷系统SQL注入五处(无需登录)

简要描述： 帝友P2P借贷系统SQL注入五处无需登录 详细说明： 帝友p2p借贷系统v4.1 http://115.47.56.82:80/ 一:username POST /blacklist/index.html HTTP/1.1 Content-Length: 14 Content-Type: application/x-www-form-urlencoded Referer: http://115.47.56.82:80/ Cookie: PHPSESSID=52h7b50hs3nid900r34hcj09k5; DNbC2132saltkey=y44yYWII;...

WP REST API (WP API) <= 1.2.2 - Cross-Site Scripting (XSS)

Requests from other origins could potentially run code on the API domain, allowing cross-origin access to authentication cookies or similar...

foreman: the _session_id cookie is issued without the Secure flag

It was found that Foreman did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...

Credentials potentially leaked to other configured ownCloud instance - ownCloud

A bug in the ownCloud iOS application below version 3.4.4 may leak credentials as well as cookies used for authentication purposes to other configured ownCloud instances. Specifically, the ownCloud iOS application allows users to connect to multiple ownCloud instances offering an easy way to swit...

Tendoo CMS 1.3 - XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Tendoo CMS Stored And Reflected Xss Vulnerability Google Dork: N/A Date: 28/7/2015 Exploit Author: Arash Khazaei Vendor Homepage: http://tendoo.org/ Software Link: http://sourceforge.net/projects/tendoo-cms/ Version: 1.3 Tested...