2541 matches found
CVE-2019-12362
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
CVE-2019-12362
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
CVE-2019-12362
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
CVE-2019-12362
CVE-2019-12362 affects EmpireCMS 7.5.0. The vulnerability is an XSS flaw exploitable via the HTTP Referer header to the endpoint e/member/doaction.php, as documented across Red Hat, NVD, CVE lists and CNVD/CVELIST entries. The available sources identify a cross-site scripting risk in EmpireCMS 7....
CVE-2019-12362: Improper Neutralization of Input During Web Page Generation
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
PT-2019-12764
Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.5.0 Description The issue allows for XSS via the HTTP Referer header to the "e/member/doaction.php" endpoint. Recommendations For EmpireCMS version 7.5.0, update to a version that fixes this issue, or as a temporary...
Design/Logic Flaw
Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter...
CVE-2018-12300
Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter...
CVE-2018-12300: URL Redirection to Untrusted Site
Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter...
WordPress WP Statistics Plugin < 12.6.3 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.142359";...
Cross site request forgery (csrf)
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request...
CVE-2019-10864
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request...
CVE-2019-10864
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request...
CVE-2019-10864
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request...
CVE-2019-10864: Improper Neutralization of Input During Web Page Generation
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request...
PT-2019-12062
Name of the Vulnerable Software and Affected Versions WP Statistics plugin versions prior to 12.6.3 Description The issue allows a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request, potentially leading to cross-site scripting XSS attacks. Recommendatio...
Hiro: Blockstack Browser For Mac leaks "Core API Password" to 3rd parties
Hi Blockstack! 😃 I noticed that BlockStack Browser for Mac version is leaking the CoreAPIPassword via Referer Header to several websites: appco.imgix.net a third party site! F471236 api.app.co seems to have some blockstack affiliation? F471235 browser-api.blockstack.org F471237 Steps to Reproduce...
Rockstar Games: Facebook OAuth Code Theft through referer leakage on support.rockstargames.com
In this report, the researcher was able to discover a method to expose and exfiltrate Oauth tokens. This was done by injecting an tag containing a payload pointing to the attacker's own domain into replies of Support Community forum threads. Once this was done, users operating under a particular...
OpenSource ERP 6.3.1. - SQL Injection
OpenSource ERP 6.3.1. - SQL Injection Exploit Title: OpenSource ERP SQL Injection Date: 10.01.2019 Exploit Author: Emre ÖVÜNÇ Vendor Homepage: http://www.nelson-it.ch Software Link: http://sourceforge.net/projects/opensourceerp/files/Windows/erp6.3.1.exe/download Version: v6.3.1 Tested on: Window...
Nextcloud: WordPress vulnerable to multiple attacks at https://nextcloud.com
summary: your current version of WordPress is available to multiple attacks check INFO.php available attacks: - Unauthenticated Arbitrary File Deletion - lib/IPTraf.php User-Agent Header Stored XSS - Password Creation Restriction Bypass - wp-admin/admin.php whois Parameter Stored XSS - XSS & IAA ...