Gratipay: Username .. (double dot) should be restricted or handled carefully

If I change my username to "test" then as in normal case it will send a GET request to /test/settings but if I change my username to ".." double dot within inverted commas then it will send GET request to /settings because /../settings will change to /settings and hence final GET request will be ...

XSS in /includes/decorators/global-translations.jsp

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Cloud. Using JIRA Server? See the corresponding bug report|http://jira.atlassian.com/browse/JRASERVER-61888. panel Somewhat hard to exploit but still doable when it comes to cache poisoning. Steps to reproduce: Tamper with a GET request to...

XSS in /includes/decorators/global-translations.jsp

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/JRACLOUD-61888. panel Somewhat hard to exploit but still doable when it comes to cache poisoning. Steps to reproduce: Tamper with a GET request to...

XSS in /includes/decorators/global-translations.jsp

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/JRACLOUD-61888. panel Somewhat hard to exploit but still doable when it comes to cache poisoning. Steps to reproduce: Tamper with a GET request to...

OLX: cross-site scripting in get request

https://olx.pt/ads/?q=?alert1 where "q" is the vulnerable parameter which triggers cross-site scripting...

The vulnerability of Juniper SRX 240 router microprogramming software allows a attacker to bypass the CSRF protection of the J-Web interface.

The Juniper SRX 240 router software contains a vulnerability in the Sajax AJAX library, which stems from the lack of checking the “csrftoken” parameter for GET requests...

ExpressionEngine: Arbitrary SQL query execution and reflected XSS in the "SQL Query Form"

Hello, The mentioned module is vulnerable to SQL injection due to the fact that a query can be done in a GET request, with the query is Base64 encoded and supplied as the value of the parameter "thequery". This allows an attacker to perform arbitrary SQL queries if they trick an authenticated adm...

Radancy: Application error message

Attack details HTTP Header input X-Forwarded-For was set to 12345'"'";|%00%0d%0a%bf%27'??? Error message found: Warning: inetpton function.inet-pton: Unrecognized address 12345'"\'\";|%00%0d%0a%00%bf%27' in...

Informatica: [oneclickdrsfdc-test.informatica.com] Tomcat Example Scripts Exposed Unauthenticated

Issue The consultant identified that there is an unauthenticated installation of apache tomcat installed on the affected host. This particular installation has the /examples directory exposed which contains several scripts that execute server side code, these scripts can also be leveraged to carr...

Teampass Arbitrary File Download Vulnerability

TeamPass is a web-based open source application. An arbitrary file download vulnerability exists in TeamPass. An unauthenticated remote attacker can download arbitrary files via a GET method request...

RoundCube Webmail Cross-Site Request Forgery Vulnerability

RoundCube Webmail is a browser-based IMAP client mail client. A cross-site request forgery vulnerability exists in RoundCube Webmail, which can be exploited by an attacker to download message attachments by sending a GET request with the download parameter set to 1...

CVE-2016-2415

exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to obtain sensitive information via a crafted application that triggers a spoofed response to a GET request, ak...

CVE-2016-2415

exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to obtain sensitive information via a crafted application that triggers a spoofed response to a GET request, ak...

Asbru Web Content Management System Detection

Detection of Asbru Web Content Management System. This script sends an HTTPS GET request and checks for the presence of the application. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

WordPress OptinMonster Plugin <= 1.1.4.5 - Execution of Arbitrary Shortcodes

Because of this vulnerability, unauthenticated users can execute arbitrary WordPress shortcodes via a simple HTTP GET request. Solution Update the plugin...

Kaltura Video Platform Detection (HTTP)

HTTP based detection of the Kaltura Video Platform. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Veris: Critical IDOR - Get Rules of any organization remotely

Hello Team, I have found a critical IDOR using which an attacker can get rules of any organization remotely by just changing the venue id in GET Request. Proof of Concept: Please find the attached screenshots. Best Regards, Hely H. Shah...

Xceedium Xsuite Remote Version Detection

Detection of installed version of Xceedium Xsuite. This script sends an HTTP GET request and tries to get the version from the response. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server allows a intruder to obtain statistical data about calls.

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server lies in the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain statistical data about calls through a specially crafte...

The vulnerability of the Cisco Unified Communications Manager system allows a perpetrator to access information related to table names and database entities.

The vulnerability of the Cisco Unified Communications Manager IP-telephony management system is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to information about table names and database...