CVE-2018-0357: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are...

CVE-2018-0354: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters...

CVE-2018-0356: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are...

PT-2018-8781

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection affected versions not specified Description A vulnerability in the web framework could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of an...

PT-2018-8784

Name of the Vulnerable Software and Affected Versions Cisco WebEx affected versions not specified Description A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of a...

PT-2018-8783

Name of the Vulnerable Software and Affected Versions Cisco WebEx affected versions not specified Description A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of a...

CVE-2018-1000195

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful 200 or not...

CVE-2018-1000195

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful 200 or not...

Server side request forgery (ssrf)

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful 200 or not...

CVE-2018-1000195

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful 200 or not...

CVE-2018-1000195: Cross-Site Request Forgery (CSRF)

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful 200 or not...

Software Advice 1.0 Cross Site Scripting

Exploit Title: Reflected XSS at Software Advice Date: 27.05.2018 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.softwareadvice.com/ Software Link: Software Advice Website Version: 1.0 Tested on: Kali Linux Reflected XSS Payload : '-confirmIsmail Tasdelen-' HTTP REQUEST HEADER :...

CVE-2018-0328

A vulnerability in the web framework of Cisco Unified Communications Manager and Cisco Unified Presence could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient...

CVE-2018-0328: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web framework of Cisco Unified Communications Manager and Cisco Unified Presence could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient...

CVE-2018-0327: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web framework of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain...

PT-2018-8758

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager and Cisco Unified Presence affected versions not specified Description A vulnerability in the web framework could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack again...

PT-2018-8757

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description A vulnerability in the web framework could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interfac...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain...

CVE-2017-14436: NULL Pointer Dereference

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXA\CFG2.ini" without a cookie head...

hik-connect.com / ezvizlife.com Authentication Bypass

There is a full write up of this bug here: https://medium.com/@evstykas/hackvision-8f50924e56d Vulnerability Security Advisory ======================================================================= title: No validation on cookie values product: hik-connect.com and ezvizlife.com vulnerable versio...