Design/Logic Flaw

PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,...

CVE-2018-17130

PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,...

PT-2018-13911

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue concerns a cross-site scripting XSS problem. It can be triggered via an HTTP Referer header in the member.php file. Recommendations For PHPMyWind version 5.5, update the member.php file to properly...

CVE-2018-17130: Improper Neutralization of Input During Web Page Generation

PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,...

CVE-2018-14398

The CVE-2018-14398 entry affects Creme CRM 1.6.12: the cancel button’s value is sourced from the HTTP Referer header, enabling potential redirection to a fraudulent login page to steal credentials. Affected component: web UI logic handling cancel navigation; root cause: using Referer content in U...

PT-2018-12489

Name of the Vulnerable Software and Affected Versions Creme CRM version 1.6.12 Description An issue was discovered where the value of the cancel button uses the content of the HTTP Referer header. This could be used to trick a user into visiting a fake login page in order to steal credentials...

CVE-2018-9186

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

CVE-2018-9186

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

Cross site scripting

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

CVE-2018-9186

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

CVE-2018-9186

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

CVE-2018-9186: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

PT-2018-18910

Name of the Vulnerable Software and Affected Versions Fortinet FortiAuthenticator versions 4.0.0 through 5.3.0 Description A cross-site scripting XSS issue exists due to a CSRF validation failure, allowing an attacker to execute unauthorized script code by injecting malicious scripts in the HTTP...

CVE-2017-7851

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

Cross site request forgery (csrf)

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

CVE-2017-7851: Cross-Site Request Forgery (CSRF)

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

CVE-2015-7391

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...

PT-2017-6352

Name of the Vulnerable Software and Affected Versions vBulletin VBSEO module affected versions not specified Description The issue allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php. This is due to a problem in the functions vbseo hook.ph...

CVE-2014-9463: Improper Control of Generation of Code

functionsvbseohook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked...