Red Hat Keycloak Cross-Site Scripting Vulnerability (CNVD-2020-01944)

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A cross-site scripting vulnerability exists in the login-status-iframe.html page in Red Hat Keycloak, which stems from a lack of proper...

CVE-2014-3656

JBoss KeyCloak: XSS in login-status-iframe.html...

Design/Logic Flaw

JBoss KeyCloak: XSS in login-status-iframe.html...

CVE-2014-3656

JBoss KeyCloak: XSS in login-status-iframe.html...

FreeBSD : typo3 -- multiple vulnerabilities (bab29816-ff93-11e8-b05b-00e04c1ea73d)

Typo3 core team reports : CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a...

Cross-Site Scripting in Frontend User Login

Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile...

Fast Breakfast App Has Arbitrary User Payment Password Change Vulnerability

Fast Breakfast APP is a mobile service software. There is an arbitrary user payment password modification vulnerability in Fast Breakfast APP. Due to the use of loginStatus and userTel parameters to query the userID of any user, it is possible to modify the payment password of any user...

DEBIAN-CVE-2016-6625

An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerability. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to...

ALPINE-CVE-2016-6625

An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerability. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to...

CVE-2014-3656

JBoss KeyCloak: XSS in login-status-iframe.html...

Random number generator and input name linebreaks can be used to send custom data to other sites

Input names can contain line breaks when data is sent using POST. Suitable use of the random number generator can reveal predictable boundaries that will be used when sending the POST data. These can be combined to add extra boundaries into the data, containing payloads that may confuse the...

Code injection

The Zyxel P-2602HW-D1A router with 3.40AJZ.1 firmware provides different responses to admin page requests depending on whether a user is logged in, which allows remote attackers to obtain current login status by requesting an arbitrary admin URI...

CVE-2008-1261

The Zyxel P-2602HW-D1A router with 3.40AJZ.1 firmware provides different responses to admin page requests depending on whether a user is logged in, which allows remote attackers to obtain current login status by requesting an arbitrary admin URI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in phpArcadeScript 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the gamename parameter in tellafriend.php, 2 the loginstatus parameter in loginbox.php, 3 the submissionstatus parameter in index.php, the 4...

xtell 2.6.1 - User Status Remote Information Disclosure

xtell 2.6.1 - User Status Remote Information Disclosure source: https://www.securityfocus.com/bid/4196/info xtell is a simple network messaging program. It may be used to transmit terminal messages between users and machines. xtell is available for Linux, BSD and most other Unix based operating...