1050 matches found
Debian DSA-4036-1 : mediawiki - security update
Multiple security vulnerabilities have been discovered in MediaWiki, a website engine for collaborative work : - CVE-2017-8808 Cross-site-scripting with non-standard URL escaping and $wgShowExceptionDetails disabled. - CVE-2017-8809 Reflected file download in API. - CVE-2017-8810 On private wikis...
Automattic: Improper markup sanitization.
Summary One can inject HTML into a note and create a login form that sends the user's details to a third-party server. This was a fun issue to play around with. I will let the PoC do most of the talking for a change. PoC Paste the following HTML into a Simplenote. I am using the Simplenote app...
Authentication flaw
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in login form, still allowing users to log in even if their institution was expired or suspended...
Login Form Authentication Succeeded
This is an informational notice that the scanner was able to successfully authenticate against the web application using the login form credentials provided in the scan policy. No source data...
Sql injection
SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary SQL commands via the username field...
Timing Attack Via Discrepancies In Response
silverstripe/cms is vulnerable to timing attacks. There are some discrepancies in the password reset and login form responses which can be misused by the attacker to enumerate the users...
CVE-2017-12849
Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks...
WordPress Shibboleth Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports the hosting of personal blog sites on servers running PHP and MySQL.The Shibboleth plugin is one of the plugins used to integrate Wordpress sites into existing identity...
DEBIAN-CVE-2017-14313
The shibbolethloginform function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of addqueryarg...
CVE-2017-3221
Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwords...
Phamm 'login_form' function cross-site scripting vulnerability
Phamm is a PHP-based web hosting manager that supports multiple roles with access rights to manage virtual services using an LDAP backend. A cross-site scripting vulnerability exists in the 'loginform' function of the views/helpers.php file in versions of Phamm prior to 0.6.7. A remote attacker c...
CVE-2017-0378
XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...
CVE-2017-0378
XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...
CVE-2017-0378
XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...
UBUNTU-CVE-2017-0378
XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...
CVE-2017-0378
XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...
D-Link DIR-100 Brute Force / Cross Site Request Forgery
Hello list! There are Brute Force and Cross-Site Request Forgery vulnerabilities in D-Link DIR-100. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DIR-100, Firmware v1.01. All other versions also must be vulnerable. ---------- Details:...
About User Enumeration
User enumeration is when a malicious actor can use brute-force to either guess or confirm valid users in a system. User enumeration is often a web application vulnerability, though it can also be found in any system that requires user authentication. Two of the most common areas where user...
SS-2017-002: Member disclosure in login form
More info at https://www.silverstripe.org/download/security-releases/ss-2017-002/...
CVE-2014-2710
Multiple cross-site scripting XSS vulnerabilities in Oliver formerly Webshare 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the 1 login page index.php or 2 login form loginform-inc.php...