Cisco Wide Area Application Services Software Scripts Privilege Escalation Vulnerability

A vulnerability in Cisco-provided scripts disk-check.sh and harcap.sh for Cisco Wide Area Application Services WAAS Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges level 15 to...

Malicious Package

Overview nothing-js contained a malicious script that attempted to delete all files when npm test was run. Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it. References GitHub Advisory...

Microsoft Sharepoint 14.x Cross Site Scripting

Title: Microsoft-sharepoint FilterValue Cross Site Scripting XSS + Date: 2018/04/04 + Author: Mostafa Gharzi + Team: Maher - CertCC.ir + Vendor Homepage: https://products.office.com/en-us/sharepoint/collaboration + Tested on: Windows 10 & Kali Linux + Versions: 14.x and Before + Vulnerable...

Open-AuditIT Professional 2.1 Cross Site Scripting

Exploit Title: Open-AuditIT Professional 2.1 - Stored Cross site scripting XSS Date: 27-03-2018 Exploit Author: Nilesh Sapariya Contact: https://twitter.com/nileshloganx Website: https://nileshsapariya.blogspot.com Vendor Homepage: https://www.open-audit.org/ Version: 2.1 CVE : CVE-2018-8903...

Reverb.com: Stored xss in shop name @ lp.reverb.com

hello team, There is a stored xss in lp.reverb.com. Attacker can inject malicious script into server while adding shop name as lll"alert'xss';. Exploit: https://lp.reverb.com/shops/faniyos-boutique/listings Steps to reproduce: 1. Navogate to https://reverb.com/my/lpshop/edit 2. Change your lp sho...

Cross site scripting

I, Librarian version 4.8 and earlier contains a Cross Site Scripting XSS vulnerability in "id" parameter in stable.php that can result in an attacker using the XSS to send a malicious script to an unsuspecting user...

mandy.com XSS vulnerability

Open Bug Bounty ID: OBB-582760 Description| Value ---|--- Affected Website:| mandy.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-5779

A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to copy a malicious script into a newly generated PHP file and then execute the generated file using special...

Security feature bypass

A vulnerability in the conferencing component of Mitel ST 14.2, release GA28 and earlier, could allow an authenticated user to upload a malicious script to the Personal Library by a crafted POST request. Successful exploit could allow an attacker to execute arbitrary code within the context of th...

CVE-2017-16251

A vulnerability in the conferencing component of Mitel ST 14.2, release GA28 and earlier, could allow an authenticated user to upload a malicious script to the Personal Library by a crafted POST request. Successful exploit could allow an attacker to execute arbitrary code within the context of th...

CVE-2017-16251

The CVE-2017-16251 entry concerns Mitel ST’s conferencing component (GA28 and earlier). A vulnerability exists where an authenticated user can upload a malicious script to the Personal Library via a crafted POST request, potentially allowing arbitrary code execution within the application context...

Stored Cross-Site Scripting Vulnerability in iZhanCMS Version v2.1

Love Station CMS is an open source and free CMS content management system. iZhanCMS v2.1 version of the stored cross-site scripting vulnerability, attackers can use the vulnerability in the page to insert malicious js code, to obtain user cookies and other information...

Keylogger Campaign Returns, Infecting 2,000 WordPress Sites

Over 2,000 WordPress sites are infected with a malicious script that can deliver both a keylogger and the in-browser cryptocurrency miner CoinHive. Researchers at Sucuri who made the discovery, said the recent campaign is tied to threat actors behind a December 2017 campaign that infected over...

OnePlus Confirms Credit Card Breach Impacted Up to 40,000 Customers

OnePlus has confirmed that up to 40,000 customers have been affected by a credit card breach, in the latest embarrassing misstep for the Chinese handset maker. The news comes several days after OnePlus shut down credit card processing following complaints from customers about fraudulent charges...

OnePlus confirms up to 40,000 customers affected by Credit Card Breach

OnePlus has finally confirmed that its online payment system was breached, following several complaints of fraudulent credit card transactions from its customers who made purchases on the company's official website. In a statement released today, Chinese smartphone manufacturer admitted that cred...

Open-Xchange: Stored XSS

Vulnerability Details: Script code within Presentations is being executed when transferring it to the clipboard. This is done by "copying" or "cutting" text using keyboard commands. Risk: Malicious script code can be executed within a users context. This can lead to session hijacking or triggerin...

stumpfffuneral.com XSS vulnerability

Open Bug Bounty ID: OBB-454209 Description| Value ---|--- Affected Website:| stumpfffuneral.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cross-site Scripting Vulnerability in JP1/Operations Analytics

Overview A cross-site scripting vulnerability was found in JP1/Operations Analytics. Impact Remote users can exploit this vulnerability to execute malicious scripts. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate action...

HackerOne: Query parameter reordering causes redirect page to render unsafe URL

Hello hackerone team I want to report I bypass w/c lead to XSS but limited only for IE due to CSP block on chrome Here is the POC ------------------ https://hackerone.com/redirect?signature=c9304cadaeabca0bfb7b92503c0318da5c42a86b&url=http%3A%2F%2Fbuglabs.me&url=JAVASCRIPT:alert%09document.domain...

CVE-2017-16659

The Gentoo mail-filter/assp package 1.9.8.13030 and earlier allows local users to gain privileges by leveraging access to the assp user account to install a Trojan horse /usr/share/assp/assp.pl script...