CVE-2019-10864: Improper Neutralization of Input During Web Page Generation

The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request...

PT-2019-12062

Name of the Vulnerable Software and Affected Versions WP Statistics plugin versions prior to 12.6.3 Description The issue allows a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request, potentially leading to cross-site scripting XSS attacks. Recommendatio...

Hiro: Blockstack Browser For Mac leaks "Core API Password" to 3rd parties

Hi Blockstack! 😃 I noticed that BlockStack Browser for Mac version is leaking the CoreAPIPassword via Referer Header to several websites: appco.imgix.net a third party site! F471236 api.app.co seems to have some blockstack affiliation? F471235 browser-api.blockstack.org F471237 Steps to Reproduce...

Nextcloud: WordPress vulnerable to multiple attacks at https://nextcloud.com

summary: your current version of WordPress is available to multiple attacks check INFO.php available attacks: - Unauthenticated Arbitrary File Deletion - lib/IPTraf.php User-Agent Header Stored XSS - Password Creation Restriction Bypass - wp-admin/admin.php whois Parameter Stored XSS - XSS & IAA ...

Technicolor MediaAccess TG789vac v2 HP Device Cross-Site Scripting Vulnerability

Technicolor MediaAccess TG789vac v2 HP is a gateway device from the French Technicolor group. A cross-site scripting vulnerability exists in the admin web interface of Technicolor MediaAccess TG789vac v2 HP devices with firmware version 16.3.7190-2761005-20161004084353, which can be exploited by...

CVE-2018-8827

The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input, which allows an unauthenticated malicious user to embed JavaScript into the Log viewer interface via a crafted HTTP Referer header, aka XSS...

CVE-2018-8827

The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input, which allows an unauthenticated malicious user to embed JavaScript into the Log viewer interface via a crafted HTTP Referer header, aka XSS...

Cross site scripting

The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input, which allows an unauthenticated malicious user to embed JavaScript into the Log viewer interface via a crafted HTTP Referer header, aka XSS...

CVE-2018-18244

Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header...

Cross site scripting

Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header...

CVE-2018-18244

Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header...

CVE-2018-18244

The CVE-2018-18244 entry corresponds to a cross-site scripting vulnerability in VIVOTEK Network Camera Series. The affected component is the syslog.html page, exploitable on firmware versions 0x06x to 0x08x. An attacker can remotely inject and execute arbitrary JavaScript in the context of a user...

CVE-2018-18244: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header...

PT-2019-11148

Name of the Vulnerable Software and Affected Versions: Technicolor MediaAccess TG789vac v2 HP version v16.3.7190-2761005-20161004084353 Description: The issue concerns the admin web interface, where unsanitized user input is displayed, allowing an unauthenticated malicious user to embed JavaScrip...

CVE-2018-8827: Improper Neutralization of Input During Web Page Generation

The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input, which allows an unauthenticated malicious user to embed JavaScript into the Log viewer interface via a crafted HTTP Referer header, aka XSS...

PT-2019-9558

Name of the Vulnerable Software and Affected Versions VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x Description The issue allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header, which is a result of cross-site scripting in the syslog.html fil...

Information Disclosure

kibana is vulnerable to information disclosure. An improperly initialized kibana login screen causes user-entered credentials to be shown in the URL bar and allows untrusted parties to obtain the user's credentials via access logs or through the Referer header when the user browses to another...

CVE-2018-18655

Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...

CVE-2018-18655

Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...

CVE-2018-18655

Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting...