334 matches found
Cross site scripting
Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form...
CVE-2017-1000488
Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form...
International Islamic University Chittagong: SQL injection in http://119.18.148.140/hrd/js/makeemployeeid.php
Hello, The mentioned page takes at least two GET parameters, namely q and departmentname. The two parameters are vulnerable to SQL injection as both are placed into SQL query strings without proper sanitization. It seems like the PHP script uses the affected parameters into two SQL queries, since...
Mail.ru: reflected XSS on healt.mail.ru
Reflected XSS via GET paramters in quiz game on promo site in health.mail.ru subdomain. .health.mail.ru was in the bug bounty program's scope on the moment of report submission...
Mail.ru: [new.wf.mail.ru] XSS Request-URI
Reflected XSS via GET parameters in new.wf.mail.ru wf.mail.ru is not currently covered with bug bounty program...
Mail.ru: [beta.tracker.my.com] XSS Request-URI
Reflected XSS via GET parameters in beta.tracker.my.com tracker.my.com is not currently covered with bug bounty program...
DALIM SOFTWARE ES Core 5.0 Build 7184.1 XSS / CSRF
!-- DALIM SOFTWARE ES Core 5.0 build 7184.1 Multiple Stored XSS And CSRF Vulnerabilities Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 build 7114.1 build 7114.0 build 7093.1 build 7093.0 buil...
CVE-2017-11418
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/articlelist.php via $GET'cat', $GET'user', $GET'level', and $GET'iSortCol'.$i...
UBUNTU-CVE-2017-7416
ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated...
CVE-2017-7416
ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated...
Cross site scripting
ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated...
CVE-2017-7416
Removed by vendor...
A Look at --- SharePoint's Follow Feature XSS(CVE-2017-8514 )
A Look at CVE-2017-8514 --- SharePoint's Follow Feature XSS TL;DR: All your SharePoint installations are belong to us. The XSS worth $2500 affecting both on-premises and online version looks like ... http|https://?FollowSite=0&SiteName='-confirmdocument.domain-' SharePoint needs no more marketing...
Joomla! Component OneVote! v1.0 - SQL Injection
Joomla! Component OneVote! v1. 0 - SQL Injection results. in php electionid parameters into the SQL statement exist GET the type of injection Injection point: http://localhost/PATH/components/comonevote/results. php? electionid=SQL union injected payload: +/! 50000union/+select+@@version-- - Test...
Munin Local File Write Vulnerability
Munin is a set of network resource monitoring tools. The tool monitors core system resources including memory, disk, CPU usage, server applications and more. A local file write vulnerability exists in Munin versions prior to 2.999.6. An attacker can exploit the vulnerability by setting multiple...
CVE-2017-6188
Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upperlimit GET parameters allows overwriting any file accessible to the www-data user...
Authorization
An issue was discovered in Phalcon Eye through 0.4.1. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP GET parameters passed to the "phalconeye-master/public/external/pydio/plugins/editor.webodf/frame.php" URL. An attacker could execute arbitrary HTML...
CVE-2017-5960
An issue was discovered in Phalcon Eye through 0.4.1. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP GET parameters passed to the "phalconeye-master/public/external/pydio/plugins/editor.webodf/frame.php" URL. An attacker could execute arbitrary HTML...
CVE-2017-5960
CVE-2017-5960 affects Phalcon Eye up to version 0.4.1. The issue stems from insufficient filtration of user-supplied data in multiple HTTP GET parameters passed to phalconeye-master/public/external/pydio/plugins/editor.webodf/frame.php, enabling an attacker to cause the browser to execute arbitra...