1284 matches found
About User Enumeration
User enumeration is when a malicious actor can use brute-force to either guess or confirm valid users in a system. User enumeration is often a web application vulnerability, though it can also be found in any system that requires user authentication. Two of the most common areas where user...
SS-2017-002: Member disclosure in login form
More info at https://www.silverstripe.org/download/security-releases/ss-2017-002/...
CVE-2014-2710
Multiple cross-site scripting XSS vulnerabilities in Oliver formerly Webshare 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the 1 login page index.php or 2 login form loginform-inc.php...
Login Form Authentication Failed
This plugin is raised when the scanner has not been able to authenticate against the web application using the login form credentials provided in the scan policy. Check the output of the plugin to get an explanation of the issue encountered by the scan. No source data...
PYSEC-2017-60
Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to 1...
Ubiquiti Inc.: Weak credentials for nutty.ubnt.com
nutty.ubnt.com has a login link, when clicking on it the user is presented with a login form. using 'admin' for both username and password results in valid session. this account allow for the upload of arbitrary files. I am checking to see if this will allow for further functionality like a websh...
WD My Cloud Mirror 2.11.153 - Authentication Bypass Remote Code Execution
WD My Cloud Mirror 2.11.153 - Authentication Bypass Remote Code Execution Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Date: 24.01.2017 Software Link: https://www.wdc.com Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website:...
WD My Cloud Mirror 2.11.153 - Authentication Bypass / Remote Code Execution
Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Date: 24.01.2017 Software Link: https://www.wdc.com Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: local 1. Description It’s possible to execute arbitra...
woodweb.com XSS vulnerability
Vulnerable URL: http://www.woodweb.com/cgi-bin/reg/reg.cgi?action=loginform&return=%22%3E%3CScRipT%3Ealert/OPENBUGBOUNTY/%3C%2FScrIpT%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...
PT-2016-6184
Name of the Vulnerable Software and Affected Versions Citrix NetScaler Gateway versions prior to 11.0 Build 66.11 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the NSC TMAC cookie. This occurs in the vpn/js/gateway login form view....
Fireware XTM Web UI Open Redirect Vulnerability
Fireware is the operating system for the WatchGuard UTM security solution. web UI to manage the device. An open redirect vulnerability exists in the Fireware XTM Web UI login form. An attacker is able to redirect to an arbitrary website via a WatchGuard Fireware XTM Web UI page...
SS-2016-006: Missing CSRF protection in login form
More info at https://www.silverstripe.org/download/security-releases/ss-2016-006/...
Fireware XTM Web UI Open Redirect
================================================================ Fireware XTM Web UI - Open Redirect ================================================================ Information -------------------- Name: Fireware XTM Web UI - Open Redirect Affected Software : Fireware XTM Web UI Affected Version...
PT-2017-13384
Name of the Vulnerable Software and Affected Versions Shibboleth plugin versions prior to 1.8 Description The issue arises from the improper use of add query arg in the shibboleth login form function within the Shibboleth plugin for WordPress, leading to an XSS vulnerability. Recommendations For...
CVE-2016-1488
Cross-site scripting XSS vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 devices before 6.00 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...
CVE-2016-1488
Cross-site scripting XSS vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 devices before 6.00 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...
PT-2016-4834
Name of the Vulnerable Software and Affected Versions Siemens OZW OZW672 versions prior to 6.00 Siemens OZW OZW772 versions prior to 6.00 Description A cross-site scripting XSS issue exists in the login form of the integrated web server, allowing remote attackers to inject arbitrary web script or...
CVE-2016-1488: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 devices before 6.00 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...
southwestmichiganfirst.com XSS vulnerability
Vulnerable URL: https://www.southwestmichiganfirst.com/admin/loginform.cfm?errmsg=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 09.02.2016 Latest check for patch:| 09.02.2016 20:27 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...