WordPress Cookie Flaw Lets Hackers Hijack Your Account

Do you own a blog on WordPress.com website? If Yes, then you should take some extra cautious while signing into your Wordpress account from the next time when connected to public Wi-Fi, because it can be hacked without your knowledge, even if you have enabled two-factor authentication. Yan Zhu, a...

Code injection

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not check whether a session cookie is current, which allows remote attackers to conduct user-search actions by leveraging possession of a 1 expired or 2 invalidated cookie...

Khan Academy: CRLF Injection

Is it possible for a remote attacker to inject custom HTTP headers. For example, an attacker can inject session cookies or HTML code. This may conduct to vulnerabilities like XSS cross-site scripting or session fixation. PoC...

Mayan-EDms Web-Based Document Management OS System - Multiple Persistent Cross-Site Scripting Vulnerabilities

Mayan-EDms Web-Based Document Management OS System - Multiple Persistent Cross-Site Scripting Vulnerabilities Exploit Title: Multiple Stored XSS Software: Maya EDMS Software Link: http://www.mayan-edms.com/downloads/Mayan%20EDMS%20v0.13.ova Version: 0.13 - latest Author: Dolev Farhi, email:...

Mayan-EDms Web-Based Document Management OS System - Multiple Persistent Cross-Site Scripting Vulnerabilities

Exploit Title: Multiple Stored XSS Software: Maya EDMS Software Link: http://www.mayan-edms.com/downloads/Mayan%20EDMS%20v0.13.ova Version: 0.13 - latest Author: Dolev Farhi, email: dolevatopenflaredotorg @f1nhack Date: 21.5.2014 Tested on: Kali Linux Vendor homepage: www.mayan-edms.com 1. About...

IBM WebSphere Portal 'FilterForm.jsp' XSS (PI15690)

The version of IBM WebSphere Portal on the remote host is affected by a cross-site scripting vulnerability in the 'FilterForm.jsp' script due to improper user input validation. An attacker can exploit this issue to execute code in the security context of a user's browser to steal authentication...

IBM WebSphere Portal 7.0.0.x < 7.0.0.2 CF28 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is affected by multiple vulnerabilities : - An unspecified denial of service vulnerability exists that allows a remote attacker to crash the host by sending a specially crafted web request. CVE-2014-0949 - A cross-site scripting XSS...

IBM WebSphere Portal 'boot_config.jsp' XSS (PI16041)

The version of IBM WebSphere Portal on the remote host is affected by a cross-site scripting vulnerability in the 'bootconfig.jsp' script due to improper user input validation. An attacker could exploit this issue to execute code in the security context of a user's browser to steal authentication...

Debian Security Advisory DSA 2934-1 (python-django - security update)

Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-0472 Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse U...

Mandriva Linux Security Advisory : wordpress (MDVSA-2014:103)

Multiple vulnerabilities has been discovered and corrected in wordpress : WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php...

SpiceWorks 7.2.00174 Cross Site Scripting Vulnerability

SpiceWorks version 7.2.00174 suffers from persistent cross site scripting vulnerabilities. Exploit Title: Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system Date: 12/05/2014 Exploit author: Dolev Farhi @f1nhack Vendor homepage: http://spiceworks.com Software Link:...

Reflected Cross-Site Scripting (XSS) Vulnerability in Storesprite

High-Tech Bridge Security Research Lab discovered XSS vulnerability in Storesprite, which can be exploited to perform Cross-Site Scripting attacks. 1 Reflected Cross-Site Scripting XSS in Storesprite: CVE-2014-3737 The vulnerability exists due to insufficient sanitisation of user-supplied data in...

SpiceWorks 7.2.00174 Cross Site Scripting

Exploit Title: Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system Date: 12/05/2014 Exploit author: Dolev Farhi @f1nhack Vendor homepage: http://spiceworks.com Software Link: http://download.spiceworks.com/Spiceworks.exe Version: 7.2.00174 Latest Tested on: Kali Linux Vendor alerte...

SpiceWorks 7.2.00174 - Persistent Cross-Site Scripting

Exploit Title: Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system Date: 12/05/2014 Exploit author: Dolev Farhi @f1nhack Vendor homepage: http://spiceworks.com Software Link: http://download.spiceworks.com/Spiceworks.exe Version: 7.2.00174 Latest Tested on: Kali Linux Vendor alerte...

F5 BIG-IP Backend Cookie Disclosure

This module identifies F5 BIG-IP load balancers and leaks backend information pool name, routed domain, and backend servers' IP addresses and ports through cookies inserted by the BIG-IP systems. This module requires Metasploit: https://metasploit.com/download Current source:...

Ubuntu Update for python-django USN-2169-2

Check for the Version of python-django OpenVAS Vulnerability Test $Id: gbubuntuUSN21692.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for python-django USN-2169-2 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is...

Design/Logic Flaw

Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secrettoken.rb, related to cookies...

CVE-2013-7134

Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secrettoken.rb, related to cookies...

Updated python-django packages fix multiple vulnerabilities

Updated python-django and python-dgango14 packages fix security vulnerabilities: Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse function. An attacker could use this issue to cause Django to import arbitrary modules from the Python path, resulti...

StopTheHacker: Reflected cross site scripting in login page

It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. Once exploited It is possible to steal or manipulate a legitimate user’s session credentials including session cookies. Request ...