Cross site scripting

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

CVE-2018-5249

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

CVE-2018-5249

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

CVE-2018-5249

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

CVE-2018-5249

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

CVE-2018-5249

Shaarli contains a Cross-site scripting (XSS) vulnerability in versions prior to 0.8.5 and 0.9.x prior to 0.9.3. An attacker can inject arbitrary code via the login form’s username field (the ban_canLogin parameter in index.php). The issue is addressed in Shaarli v0.9.3 and v0.8.5 releases refere...

CVE-2018-5249

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

CVE-2018-5249: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

PT-2018-16838

Name of the Vulnerable Software and Affected Versions Shaarli versions prior to 0.8.5 Shaarli versions 0.9.x prior to 0.9.3 Description The issue allows remote attackers to inject arbitrary code via the login form's username field, which is passed to the ban canLogin function in index.php. This...

Information disclosure

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

CVE-2017-1000481

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

CVE-2017-1000481: URL Redirection to Untrusted Site

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

Apache Sling Authentication Service Credential Leakage Vulnerability

Apache Sling is the United States Apache Apache Software Foundation for the Java platform for a set of open source Web framework. The framework can be created in the JCR content repository Java Content Repository on the content-oriented applications . Authentication Service is one of the...

CVE-2017-15700

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

CVE-2017-15700

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

MGASA-2017-0429 Updated mediawiki packages fix security vulnerabilities

XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping CVE-2017-8808. Reflected File Download from api.php CVE-2017-8809. On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password CVE-2017-8810. It's possible to...

Updated mediawiki packages fix security vulnerabilities

XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping CVE-2017-8808. Reflected File Download from api.php CVE-2017-8809. On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password CVE-2017-8810. It's possible to...

Debian DSA-4036-1 : mediawiki - security update

Multiple security vulnerabilities have been discovered in MediaWiki, a website engine for collaborative work : - CVE-2017-8808 Cross-site-scripting with non-standard URL escaping and $wgShowExceptionDetails disabled. - CVE-2017-8809 Reflected file download in API. - CVE-2017-8810 On private wikis...

Automattic: Improper markup sanitization.

Summary One can inject HTML into a note and create a login form that sends the user's details to a third-party server. This was a fun issue to play around with. I will let the PoC do most of the talking for a change. PoC Paste the following HTML into a Simplenote. I am using the Simplenote app...

Authentication flaw

Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in login form, still allowing users to log in even if their institution was expired or suspended...