926 matches found
CVE-2016-5953
IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL...
JIRA Server can be DOSed through a specific error page resource.
JIRA had a specific error page resource that when repeatedly accessed could result in more memory being used eventually resulting in java running out of heap space...
JIRA Server can be DOSed through a specific error page resource.
JIRA had a specific error page resource that when repeatedly accessed could result in more memory being used eventually resulting in java running out of heap space...
JIRA Server can be DOSed through a specific error page resource.
JIRA had a specific error page resource that when repeatedly accessed could result in more memory being used eventually resulting in java running out of heap space...
Quora: [controlsyou.quora.com] 429 Too Many Requests Error-Page XSS
Summary: XSS on the error page when the user makes too many requests. Steps To Reproduce 1. Make a lot of requests to get the error 429 2. Open PoC in FireFox https://controlsyou.quora.com/'-alertdocument.domain-' HTTP Response ... ga'set', 'dimension1', 'board-'-alertdocument.domain-''; ga'set',...
CVE-2016-0378
IBM WebSphere Application Server WAS Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception...
LocalTapiola: Error Page Content Spoofing or Text Injection (viestinta.lahitapiola.fi)
Hi team! I want to report a context spoofing or text injection at the new scope added viestinta.lahitapiola.fi Vulnerability Description: The new scope allows users to inject any content on the 404 not found webpage Vulnerable Location:...
Yelp: Possible content spoofing due to missing error page
https://hackerone.com/reports/164137 , https://hackerone.com/reports/115284 ETC GO TO https://www.yelp.com/%0ATEXT%20INJECT...
ExpressionEngine: Reflective XSS
URL http://blackdoorsec.net/sandbox/express/admin.php?/cp/members/bans&search=&sortcol=me%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3Emberid&sortdir=desc URL Parameters /cp/members/bans search= sortcol=me%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3Emberid sortdir=desc The...
Yelp: Error Page Text Injection
Hello Yelp team, Description : An attacker is able to inject his own text into error page and can fool the victim to visit his own malicious site. Please take a look at attached document, it contains POC as well as attack scenario about how the attacker can exploit this vulnerability and...
IBM WebSphere Application Server Liberty Information Disclosure Vulnerability
IBM WebSphere Application Server is an application server product developed and distributed by IBM in the United States, which is a platform for Java EE and Web services applications. IBM WebSphere Application Server The program fails to properly handle exceptions when the default error page does...
Cybozu Garoon fails to restrict access permissions
Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon fails to restrict access permissions in the error page. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information...
The vulnerability of the Firefox browser, which allows attackers to carry out spoofing attacks
The vulnerability of Firefox browsers is related to the incorrect installation of the "LINKABLE" and "URISAFEFORUNTRUSTEDCONTENT" flags, which are used for error pages. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks using specially crafted URLs...
Nextcloud: demo.nextcloud.com: Content spoofing due to default Apache Error Page
Hello there , your site is vulnerable to phishing the users by this vulnerability. proof of concept...
Phabricator: Error page Text Injection.
AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...
Nextcloud: demo.nextcloud.com: Content spoofing due to default Apache Error Page
Hi ,I would like to report report a text injection and a miss-configuration of the 403 page which can be used in phishing. POC:...
bharathospitalityware.com XSS vulnerability
Vulnerable URL: http://bharathospitalityware.com/error.asp?msg=%3Cscript%3Ealert%27OPENBUGBOUNTY%27%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...
The vulnerability of the Zyxel ZLD operating system allows a remote attacker to execute arbitrary code on the web server.
Exploiting a vulnerability in the operating system of the Zyxel ZyWALL USG 300 network firewall/switch allows a malicious actor to inject any desired web script through the Referer header. This is done by improperly handling the “404” error page, thereby compromising the integrity of data process...