1349 matches found
CVE-2017-3161
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting XSS attack through an unescaped query parameter...
CVE-2017-3162
HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0...
CVE-2017-3161
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting XSS attack through an unescaped query parameter...
CVE-2017-3162: Improper Input Validation
HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0...
CVE-2017-3161: Improper Neutralization of Input During Web Page Generation
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting XSS attack through an unescaped query parameter...
Subrion CMS SQL Injection Vulnerability
Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A SQL injection vulnerability exists in the admin/database/ URI in Subrion CMS version 4.0.5.10. A remote...
CVE-2017-6013
Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter...
Sql injection
Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter...
CVE-2017-6013: Improper Neutralization of Special Elements used in an SQL Command
Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter...
Sql injection
Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson formerly ESBUS allow remote attackers to execute arbitrary SQL commands via the 1 TABLE parameter to esbus/servlet/GetSQLData or 2 QUERY parameter to KKLS9ReportingPortal/GetData...
CVE-2017-6550
Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson formerly ESBUS allow remote attackers to execute arbitrary SQL commands via the 1 TABLE parameter to esbus/servlet/GetSQLData or 2 QUERY parameter to KKLS9ReportingPortal/GetData...
CVE-2017-6550: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson formerly ESBUS allow remote attackers to execute arbitrary SQL commands via the 1 TABLE parameter to esbus/servlet/GetSQLData or 2 QUERY parameter to KKLS9ReportingPortal/GetData...
Reflective cross-site scripting vulnerability in multiple parameters of DuoDuo Rebate System V8.3_UTF8 official version
DuoDuo rebate system is for e-commerce rebate, shopping guide to provide solutions, is the open source PHP rebate site system. DuoDuoRebate.com system V8.3UTF8 official version February 10, 2017 There is a reflective cross-site scripting vulnerability. Due to the code parameter , ddusername...
falke.com XSS vulnerability
Vulnerable URL: http://www.falke.com/dede/search?query=1zqjqe...
U.S. Dept Of Defense: Video player on ███ allows arbitrary remote videos to be played
Summary: A Flash video player hosted on ███████ can be provided with an arbitrary remote XML file via the url query string parameter. Description: The Flash video player http://█████/shared/widgets/popup.asp uses the url query string parameter as an address to fetch an RSS feed type XML document...
udt.ru XSS vulnerability
Vulnerable URL: http://udt.ru/search/?q=%22%3E%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3E=%D0%9F%D0%BE%D0%B8%D1%81%D0%BA Details: Description| Value ---|--- Patched:| Yes, at 22.05.2017 Latest check for patch:| 22.05.2017 03:08 GMT Vulnerability type:| XSS Vulnerability status...
The vulnerability of the cgiPutts function on the CUPS printing server allows a hacker to inject any JavaScript or HTML code into the generated web interfaces.
The vulnerability in the cgiPutts function cgi-bin/template.c of the CUPS printing server is related to insufficient protection of the web page structure. Exploiting this vulnerability allows an attacker to inject arbitrary JavaScript or HTML code into the web pages generated by the system throug...
CVE-2016-3703
Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an accesstoken in the quer...
3: Untrusted content loaded via the API proxy can access web console credentials on the same domain
An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized accesstoken was provided in t...