Mail.ru: Reflected XSS in User-Agent

Уязвимость существует на сайтах: 11x11.mail.ru s2.11x11.mail.ru Злоумышленник может внедрить произвольный User-Agent, содержащий JS код. Для примера - alert/BigBear/!--...

PHPYUN云人才系统多处存储型XSS打包

简要描述： 梦见一个getshell，但因为该死的过滤没绕过。。发xss吧。。。 多处打包，还不走大厂商吗？ 详细说明： phpyun云人才系统处理富文本时，只在客户端进行过滤，服务端没有进行过滤，导致多个富文本编辑框产生XSS。 说一下各个位置。 01.企业用户资料处：member/index.php?C=info 02.企业用户发布招聘信息处：member/index.php?C=jobadd 03.问答系统提问处：ask/index.php?C=addquestion 04.朋友圈发表状态：friend/index.php...

StartBBS v1.1.5存储型xss

简要描述： 存储型xss。 详细说明： 用户资料修改处，可以填写用户网站。 一般填写url的地方容易出现xss，很多人忽略。 观察代码，app/controllers/settings.php 36行 $data = array 'uid' = $uid, 'email' = striptags$this-input-post'email', 'homepage' = prepurlstriptags$this-input-post'homepage', 'location' = striptags$this-input-post'location', 'qq' =...

WordPress Js-Multi-Hotel Plugin Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

PT-2016-6654

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.15 phpMyAdmin versions 4.4.x through 4.4.15.6 phpMyAdmin versions 4.6.x through 4.6.2 Description The issue allows remote attackers to cause a denial of service via a large array in the scripts paramete...

Vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! These are vulnerabilities in Js-Multi-Hotel plugin for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Js-Multi-Hotel 2.2.1 and previous versions. ------------------------- Affected vendors: ------------------------- Joomlaskin...

XSS and FPD vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! These are vulnerabilities in Js-Multi-Hotel plugin for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Js-Multi-Hotel 2.2.1 and previous versions. ------------------------- Affected vendors: ------------------------- Joomlaskin...

Multiple vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! There are multiple vulnerabilities in Js-Multi-Hotel plugin for WordPress. Earlier I wrote about two other vulnerabilities. These are Abuse of Functionality, Denial of Service, Cross-Site Scripting and Full path disclosure vulnerabilities in Js-Multi-Hotel plugin for WordPress. Ther...

CVE-2014-2260

Cross-site scripting XSS vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality...

PT-2014-4590

Name of the Vulnerable Software and Affected Versions Ajenti versions 1.2.13 through 1.2.14 Ajenti version 1.2.15 is not affected, so versions prior to 1.2.15 are vulnerable. However, since 1.2.13 is the lowest version mentioned as vulnerable, the range can be simplified to: Ajenti versions 1.2.1...

KLA10121 SUI vulnerability in Mozilla Firefox

Unspecified vulnerability was found in the Mozilla Firefox. By exploiting this vulnerability malicious users can spoof the address bar. This vulnerability can be exploited remotely at a point related to DOM events via a specially designed JS. Original advisories MFSA Exploitation Related products...

CVE-2013-7220

js/ui/screenShield.js in GNOME Shell aka gnome-shell before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search...

CVE-2013-7220: Undefined Security Weakness

js/ui/screenShield.js in GNOME Shell aka gnome-shell before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search...

PT-2014-3289

Name of the Vulnerable Software and Affected Versions GNOME Shell aka gnome-shell versions prior to 3.8 Description The issue allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search field in the...

WordPress JS External Link Info Cross Site Scripting

Exploit Title : Wordpress Wp Js External link Info Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://wordpress.org Google Dork : inurl:wp-content/plugins/wp-js-external-link-info Date : 2014/4/16 Tested on : Windows 7 , Linux Version : 1.21 Exploit :...

CVE-2012-5565

Cross-site scripting XSS vulnerability in js/compose-dimp.js in Horde Internet Mail Program IMP before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic vi...

PT-2014-2339

Name of the Vulnerable Software and Affected Versions Horde Internet Mail Program IMP versions prior to 5.0.24 Horde Groupware Webmail Edition versions prior to 4.0.9 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafte...

CVE-2012-5565: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/compose-dimp.js in Horde Internet Mail Program IMP before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic vi...

PhotoWIFI Lite 1.0 iOS - Multiple Vulnerabilities

PhotoWIFI Lite 1.0 iOS - Multiple Vulnerabilities Document Title: =============== PhotoWIFI Lite v1.0 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1239 Release Date: ============= 2014-03-27 Vulnerability Laboratory ...

Lazybone Studios WiFi Music 1.0 iOS - Multiple Vulnerabilities

Document Title: =============== Lazybone Studios WiFi Music 1.0 iOS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1233 Release Date: ============= 2014-03-21 Vulnerability Laboratory ID VL-ID:...