Mail.ru: Reflective Xss on news.mail.ru and admin.news.mail.ru

Hello folks I know this is out of scope for a bounty but I thought I'd report it anyway. The XSS appears in the date parameter and there are two examples below. https://news.mail.ru/currency.html?date=%22%3E%3Csvg%3E%3Cscript%3E/%3C@/%3Eprompt%28document.domain,document.cookie%29%3C/script%3E...

Cross site scripting

Cross-site scripting XSS vulnerability in the admin-login panel admin/index.cgi in Cosmoshop allows remote attackers to inject arbitrary web script or HTML via the username field uname parameter...

CVE-2015-2103

CVE-2015-2103 describes a Cross‑site Scripting (XSS) flaw in Cosmoshop’s admin-login panel (admin/index.cgi). The vulnerability allows remote attackers to inject arbitrary web script or HTML through the username field (u_name parameter). According to the NVD entry, the impact is partial integrity...

PT-2015-5610

Name of the Vulnerable Software and Affected Versions Cosmoshop affected versions not specified Description A cross-site scripting XSS issue exists in the admin-login panel, specifically in the admin/index.cgi endpoint, allowing remote attackers to inject arbitrary web script or HTML via the u na...

CVE-2015-2103: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the admin-login panel admin/index.cgi in Cosmoshop allows remote attackers to inject arbitrary web script or HTML via the username field uname parameter...

PT-2014-8955

Name of the Vulnerable Software and Affected Versions Scalix Web Access version 11.4.6.12377 Description A cross-site scripting XSS issue exists in the mail administration login panel, allowing remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized...

CVE-2014-9352: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the mail administration login panel in Scalix Web Access 11.4.6.12377 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

RobotStats 1.0 - HTML Injection

Title : RobotStats v1.0 HTML Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo : http://alpesoiseaux.free.fr/robotstats/ Download :...

RobotStats 1.0 SQL Injection

Title : RobotStats v1.0 robot param SQL Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo : http://alpesoiseaux.free.fr/robotstats/ Download :...

Maarch LetterBox 2.8 - (Authentication Bypass) Insecure Cookies

Title : Maarch LetterBox 2.8 Insecure Cookie Handling Vulnerability Login Bypass Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Date : 17.11.2014 Demo : http://www.era.sn/courrier Download :...

CVE-2014-4719

Cross-site scripting XSS vulnerability in the login panel svn/login/ in User-Friendly SVN aka USVN before 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the username field...

Cross site scripting

Cross-site scripting XSS vulnerability in the login panel svn/login/ in User-Friendly SVN aka USVN before 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2014-4719

Cross-site scripting XSS vulnerability in the login panel svn/login/ in User-Friendly SVN aka USVN before 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2014-4719

User-Friendly SVN (USVN) is affected by an XSS in the login panel (svn/login/) prior to version 1.0.7, allowing an attacker to inject arbitrary script via the username field. The vulnerability is documented in CVE-2014-4719 with a base CVSS2 score of 4.3 (I=P). Affected component is the login han...

User Friendly SVN Cross Site Scripting

Exploit Title : User friendly svnweb based interface reflected xss vulnerability Author : Manish Kishan Tanwar Vendor : http://www.usvn.info/ version affected: below 1.0.7 Date : 21/06/2014 Discovered @ : INDISHELL Lab Love to : zero cool,Team indishell,Hardeep Singh,jagriti email :...

Mavenlink: Login password guessing attack

I have found out that an attacker can perform brute force attack on your login panel because there is no rate limitation to prevent this attack...

joola.io: Login password guessing attack

Your joola main login panel does not have rate limiting enabled to prevent brute force attacks on its panel...

Mail.ru: Clicjacking on Login panel

i am able to run on frame which lead to click jacking, Find Details on screen shot...

Web File Browser 0.4bX UploadFile/DownloadFile Vulenrabilities

Exploit for php platform in category web applications + Author: TUNISIAN CYBER + Exploit Title: Web File Browser 0.4bX UploadFile/DownloadFile Vulenrabilities + Date: 14-12-2013 + Category: WebApp + Vendor: http://sourceforge.net/projects/webfilebrowser/files/webfilebrowser/ + Google Dork:...

PT-2012-4632

Name of the Vulnerable Software and Affected Versions IBM Power Hardware Management Console HMC versions 7R7.1.0 through 7R7.1.0 before SP4 IBM Power Hardware Management Console HMC versions 7R7.2.0 through 7R7.2.0 before SP2 IBM Power Hardware Management Console HMC version 7R7.3.0 Description A...