UBUNTU-CVE-2017-12978

lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user...

DEBIAN-CVE-2017-12978

lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user...

CVE-2017-12978

lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user...

CVE-2017-12978

lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user...

CVE-2017-12978

lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user...

Oolong CVE-2017-8570 samples and behind the idea-vulnerability warning-the black bar safety net

The so-called CVE-2017-8570 sample Last week, 360 days eye lab found foreign hackers on Github released a CVE-2017-8570 exploits code, but then deleted, in order to find quite a few labeled as CVE-2017-8570 Office malware samples, such as the following VirusTotal is marked as CVE-2017-8570 sample...

Arbitrary Blog Ownership

Moodle is vulnerable to arbitrary blog ownership. If an authenticated user edits a blog through an external blog link, the ownership changes to the current user...

SQL injection vulnerability in the create_share.php page of TreeHole's external link system

Treehole external chain system is a free and open source PHP external chain network disk system, support for seven cattle, local, remote three kinds of storage methods, support for multi-user system. Treehugger createshare.php page SQL injection vulnerability , because the program fails to filter...

CVE-2016-4334

Jive before 2016.3.1 has an open redirect from the external-link.jspa page...

ExpressionEngine: Arbitrary file upload when setting an avatar

Hello, When an administrator attempts to set an avatar from an external link, the parser just takes the source of whatever link they point it to and creates a file with the same extension and content in the uploads folder. Steps to reproduce: 1- Visit...

HackerOne: Homograph attack in escalate report

Hi There, i think i found issue lead to forced the victim user to open malicious site: http://ebаy.com/ please open this: http://ebаy.com/ after that you will see external link warning page and you will see the real site: http://xn--eby-7cd.com/ and that's the way you protected users from this...

Prezi Bug Bounty Open Redirect Vulnerability

Prezi is a cloud-based presentation software. Prezi Bug Bounty has an open redirection vulnerability. Allows remote attackers Allows remote attackers to execute an external url...

community.pharos.com XSS vulnerability

Vulnerable URL: https://community.pharos.com/external-link.jspa?url=https://www.openbugbounty.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google...

community.pinkpetro.com XSS vulnerability

Vulnerable URL: https://community.pinkpetro.com/external-link.jspa?url=https://www.openbugbounty.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google...

Moodle Design Vulnerability (CNVD-2016-01812)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in Moodle version 2.8.x before 2.8.11. An attacker cou...

WordPress JS External Link Info <= 1.21 - Open Redirect vulnerability

WordPress JS External Link Info is vulnerable to open redirect vulnerability. Solution This plugin is cloded, you should find an alternative...

diendanlequydon.com vulnerability

Vulnerable URL: http://diendanlequydon.com/externallink.php?url=http://xssposed.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 95227 Google Pagerank| 1 VIP website status:| No Check diendanlequydon.com...

HackerOne: Content Spoofing - External Link Warning Page

Here is example link: Click Here Raw Data: Click Here Issue: In External link warning page, this link shown as plain text and no forced URL encoded, leading an attacker to frame sentences and trick users. In given example, attacker can trick user to click 'Proceed' button saying it will redirect...

HackerOne: Homograph Attack

Hello HackerOne, Fix of Report 29491 and 58612 is incomplete. I found another way to to replicate homograph attack using Hex Code: www.%00ebаy.com www.%01ebаy.com www.%02ebаy.com www.%03ebаy.com www.%04ebаy.com www.%05ebаy.com www.%06ebаy.com www.%07ebаy.com www.%08ebаy.com www.%0Bebаy.com...

HackerOne: Homograph attack

Hello! I would like to report that fix of report 29491 is incomplete. There is another way to reproduce homograph attack: or IDNs are displayed in unicode and there is no encoding into Punycode on external link warning page Thanks! - Matvejs...