CVE-2017-16684

SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for functionalities that require user identity...

CVE-2017-16681

Cross-Site Scripting XSS vulnerability in SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, 4.30, as user controlled inputs are not sufficiently encoded...

VK.com: self-xss ads_easy_promote vk.com

Self-XSS в рекламе...

SAP Business Intelligence Promotion Management Application Security Bypass Vulnerability

SAP Business Intellignece BI is a set of business intelligence software from SAP, which provides report query, data analysis, data mining, data backup and recovery, etc. Promotion Management Application Enterprise is one of the enterprise promotion Management Application Enterprise is one of the...

SAP Business Intellignece Promotion Management Application Enterprise Cross-Site Scripting Vulnerability

SAP Business Intellignece BI is a set of business intelligence software from SAP, which provides report query, data analysis, data mining, data backup and recovery, etc. Promotion Management Application Enterprise is one of the enterprise promotion Management Application Enterprise is one of the...

promotion.intercasino.com XSS vulnerability

Open Bug Bounty ID: OBB-388571 Description| Value ---|--- Affected Website:| promotion.intercasino.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventi...

Microsoft Edge Chakra - 'JavascriptArray::ConcatArgs' Type Confusion

void JavascriptArray::ConcatArgsRecyclableObject pDestObj, TypeId remoteTypeIds, Js::Arguments& args, ScriptContext scriptContext, uint start, uint startIdxDest, BOOL firstPromotedItemIsSpreadable, BigIndex firstPromotedItemLength, bool spreadableCheckedAndTrue JSREENTRANCYLOCKjsReentLock,...

namebrandwigs-sale.com XSS vulnerability

Vulnerable URL: http://www.namebrandwigs-sale.com/SSList.asp?promotion=1"...

Failed to Promote vDisk from Remote PVS Server

Failed to promote vdisk version from remote PVS server due to error "DeviceIoControl error: A device attached to the system is not functioning." And this vDisk Remote Mount error does not prevent Promotion of a vDisk Version, which will leave the vDisk in an unusable state. Customer will encounte...

Abuse of Apple Search Ads Feature Leading to Fraud

Apple has removed one of its top 10 grossing productivity apps after an independent developer’s story about fraudsters’ abuse of the App Store’s Search Ads functionality went viral. Search Ads is a new feature available to iOS developers that allows them to invest in the promotion of their apps...

SQL injection vulnerability in the hongbaobiaozhun parameter of the Shield Spirit public number promotion system v1.3

Shield Spirit public number promotion system is mainly applied to public number promotion alliance, suitable for personal and business subscription number and service number or enterprise number. Shield Spirit public promotion system v1.3 in the hongbaobiaozhun parameters exist sql injection...

JVN#25078144: Source code security studying tool iCodeChecker vulnerable to cross-site scripting

Source code security studying tool iCodeChecker provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Do not use Source code security studying tool...

JVN#20870477: Hands-on Vulnerability Learning Tool "AppGoat" vulnerable to remote code execution

AppGoat provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a hands-on vulnerability learning tool. Hands-on Vulnerability Learning Tool "AppGoat" for Web Application contains a remote code execution vulnerability. Impact When accessing a specially crafted URL, arbitrary code may be...

Parameters in userinfo.php in Shield Spirit public number promotion system v1.3 have sql injection vulnerabilities

Shield Spirit public number promotion system is mainly applied to public number promotion alliance, suitable for personal and business subscription number and service number or enterprise number. Shield Spirit public promotion system v1.3 userinfo.php parameters in the existence of sql injection...

Information-Technology Promotion Agency Empirical Project Monitor - eXtended Cross-Site Scripting Vulnerability (CNVD-2017-07737)

Information-Technology Promotion Agency Empirical Project Monitor - eXtended is a project progress monitoring software for the Information-Technology Promotion Agency in Japan. eXtended is a project progress monitoring software for the Information-Technology Promotion Agency in Japan. A cross-sit...

JVN#11326581: Empirical Project Monitor - eXtended vulnerable to cross-site scripting

Empirical Project Monitor - eXtended provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA contains a reflected cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Do not use Empirical Project Monitor - eXtended The...

cite.com.my XSS vulnerability

Vulnerable URL: https://www.cite.com.my/promotion.php?id="alert/OPENBUGBOUNTY/...

napatrahotel.com XSS vulnerability

Vulnerable URL: http://www.napatrahotel.com/promotion.php?id=〈=en...

Security guide for website operators vulnerable to OS command injection

Overview Security guide for website operators provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA contains an OS command injection vulnerability CWE-78 due to an issue in loading saved data. This vulnerability was reported by IPA to notify users of its solution through JVN. JPCERT/CC a...

Arbitrary code execution vulnerability in Shield Spirit public number promotion system setup.php page

Shield Spirit Public Promotion System is a product that is mainly applied to public promotion alliance. An arbitrary code execution vulnerability exists in the setup.php page of the Shield Spirit Public Promotion System. Allow attackers to exploit the vulnerability to directly execute code...