SAP NetWeaver 7.3 AS Java XSS in CAFAdapterTest servlet

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java 7.3 Vendor URL: SAP Bug: XSS Reported: 13.12.2016 Vendor response: 14.12.2016 Date of Public Advisory: 13.06.2017 Reference: SAP Security Note 2405943 Authors: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

Oracle PeopleSoft – XSS vulnerability

Application: Oracle PeopleSoft Vendor: Oracle Bug: XXS Reported: 31.10.2016 Vendor response: 1.11.2016 Date of Public Advisory: 17.01.2017 Reference: Oracle CPU Jan 2017 Authors: Vahagn Vardanyan, Dmitry Yudin VULNERABILITY INFORMATION Class: XSS CWE-79 Impact: steal information Remotely...

Serendipity 2.0.2 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: XSS Vulnerability in Serendipity Affected Software : Serendipity Affected Versions: v2.0.2 and possibly below Vendor Homepage : http://www.s9y.org Vulnerability Type : Cross-site Scripting Severity : Important Status : Fixed CVE-ID :...

HP System Management Homepage Cross-Site Request Forgery Vulnerability

HP System Management Homepage is a Web-based interface released by Hewlett-Packard HP. The interface consolidates and simplifies the single system management process SMH for HP servers running HP-UX, Linux and Microsoft Windows operating systems. A cross-site request forgery vulnerability exists ...

Quick Paypal Payments 3.0 - Presistant XSS (0day)

No description provided by source. TITLE ===== Quick Paypal Payments - Persistent Cross Site Scripting Vulnerability AUTHOR ====== Zy0d0x BLOG ==== https://zy0d0x.com DATE ==== 10/08/2013 VENDOR ====== Quick Plugins - http://quick-plugins.com/ AFFECTED PRODUCT ================ Quick Paypal Paymen...

xt:Commerce 3.04 XTCsid Parameter Session Fixation

No description provided by source. source: http://www.securityfocus.com/bid/31313/info xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability. An attacker can leverage the session-fixation issue to hijack a session of ...

WordPress Dexs PM System Cross Site Scripting

=============================================================================== | | / / / / / / // / / -alert'xss'; --- SNIP --- If the message has been sent successfully a alert diolog will apear containing xss when an user checks there...

WordPress Dexs PM System Plugin - Authenticated Persistent XSS

Dexs PM System plugin is prone to an authenticated persistent XSS vulnerability that exists because of input validation and output sanitization of the subject paramater. It allows an attacker to potentially hijack session authentication Solution Upgrade the plugin...

WordPress Plugin Quick Contact Form 6.0 - Persistent Cross-Site Scripting

=============================================================================== | | / / / / / / // / / -alertString.fromCharCode90,121,48,100,48,120 --...

CVE-2013-4213

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

Apache Tomcat: Multiple vulnerabilities

Background Apache Tomcat is a Servlet-3.0/JSP-2.2 Container. Description Multiple vulnerabilities have been discovered in Apache Tomcat. Please review the CVE identifiers referenced below for details. Impact The vulnerabilities allow an attacker to cause a Denial of Service, to hijack a session, ...

Vulnerability Note VU#261869

Vulnerability Note VU261869 Clientless SSL VPN products break web browser domain-based security models Overview Clientless SSL VPN products from multiple vendors operate in a way that breaks fundamental browser security mechanisms. An attacker could use these devices to bypass authentication or...

RunCMS 2m1 store() SQL injection

No description provided by source. ?php / RunCms v.2M1 store - 'pid' remote SQL Injection Exploit by Nine:Situations:Group::bookoo site: http://retrogod.altervista.org/ software site: http://www.runcms.org/ Function store in /modules/forum/class/class.forumposts.php is vulnerable, see lines...

CVE-2009-2192

The CVE-2009-2192 issue affects Mac OS X 10.5 prior to 10.5.8, where the MobileMe preference pane fails to delete all credentials on sign-out due to a logic issue. This could allow continued access to a MobileMe account after sign-out. Connected sources (OpenVAS/NVD-family entries) confirm that t...

IBM WebSphere Application Server < 6.0.2.33 Multiple Vulnerabilities

Binary data 4990.prm...

CVE-2008-6039

Session fixation vulnerability in BLUEPAGE CMS 2.5 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

xt:Commerce 3.04 - XTCsid Session Fixation

xt:Commerce 3.04 - XTCsid Session Fixation source: https://www.securityfocus.com/bid/31313/info xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability. An attacker can leverage the session-fixation issue to hijack a...

xt:Commerce 3.04 - 'advanced_search_result.php?keywords' Cross-Site Scripting

source: https://www.securityfocus.com/bid/31313/info xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability. An attacker can leverage the session-fixation issue to hijack a session of an unsuspecting user. The attacker...

xt:Commerce 3.04 - 'XTCsid' Session Fixation

source: https://www.securityfocus.com/bid/31313/info xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability. An attacker can leverage the session-fixation issue to hijack a session of an unsuspecting user. The attacker...

CVE-2002-1672

Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions world readable, which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials...