2541 matches found
CVE-2017-15572
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information password reset tokens by reading a Referer log, because account/lostpassword does not use a redirect...
CVE-2017-15572: Insertion of Sensitive Information into Log File
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information password reset tokens by reading a Referer log, because account/lostpassword does not use a redirect...
PT-2017-14104
Name of the Vulnerable Software and Affected Versions Redmine versions prior to 3.2.6 Redmine versions 3.3.x prior to 3.3.3 Description The issue allows remote attackers to obtain sensitive information, specifically password reset tokens, by reading a Referer log. This is because the account/lost...
PT-2017-14048
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 62.0.3202.62 Opera affected versions not specified Description The issue is related to Insufficient Policy Enforcement in Devtools remote debugging, allowing a remote attacker to obtain access to remote debuggin...
Avito: CSS injection in avito.ru via IE11
Hi Team Security @avito I discovered CSS Injection on avito.ru in form search via IE11 Description CSS injection vulnerabilities arise when an application imports a style sheet from a user-supplied URL, or embeds user input in CSS blocks without adequate escaping. They are closely related to...
Cross site request forgery (csrf)
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...
CVE-2016-6806: Cross-Site Request Forgery (CSRF)
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...
CVE-2016-6806
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...
PT-2017-9021
Name of the Vulnerable Software and Affected Versions Apache Wicket versions 6.x through 6.24.0 Apache Wicket versions 7.x through 7.4.0 Apache Wicket version 8.0.0-M1 Description The issue concerns a CSRF prevention measure that fails to identify certain cross-origin requests. This is because it...
SmarterStats 11.3.6347 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications ---------------------------- Title: CVE-2017-14620 ---------------------------- TL;DR: SmarterStats Version 11.3.6347, and possibly prior versions, will Render the Referer Field of HTTP Logfiles in URL /Data/Reports/ReferringURLsWithQueries...
CVE-2017-14620
SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in Stored Cross Site Scripting...
Cross site scripting
SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in Stored Cross Site Scripting...
CVE-2017-14620: Improper Neutralization of Input During Web Page Generation
SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in Stored Cross Site Scripting...
PT-2017-13586
Name of the Vulnerable Software and Affected Versions SmarterStats version 11.3.6347 Description The issue concerns a stored cross-site scripting problem. It occurs when the Referer Field of HTTP logfiles is rendered from the URL /Data/Reports/ReferringURLsWithQueries, allowing for potential...
CVE-2015-7391
Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...
CVE-2015-7391
Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...
CVE-2015-7391
Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...
Student Result or Employee Database <= 1.6.3 - Auth Bypass
The Student Result or Employee Database WordPress plugin was affected by an Auth Bypass security vulnerability. curl -i -s -k -X 'POST' -H 'User-Agent: Mozilla/5.0' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'X-Requested-With: XMLHttpRequest' -H 'Referer:...
vBulletin VBSEO 'visitormessage.php' Remote Code Injection Vulnerability
vBulletin is the United States Internet Brands and vBulletin Solutions, Inc. jointly developed an open source commercial Web forum program. vBulletin VBSEO module is one of the SEO management module . A security vulnerability exists in the functionsvbseohook.php file in the vBulletin VBSEO module...