FreeBSD : moodle -- multiple vulnerabilities (a430e15d-f93f-11e5-92ce-002590263bf5)

Marina Glancy reports : - MSA-16-0003: Incorrect capability check when displaying users emails in Participants list - MSA-16-0004: XSS from profile fields from external db - MSA-16-0005: Reflected XSS in moddata advanced search - MSA-16-0006: Hidden courses are shown to students in Event Monitor ...

moodle -- multiple vulnerabilities

Marina Glancy reports: MSA-16-0003: Incorrect capability check when displaying users emails in Participants list MSA-16-0004: XSS from profile fields from external db MSA-16-0005: Reflected XSS in moddata advanced search MSA-16-0006: Hidden courses are shown to students in Event Monitor...

Open redirect

Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referrer parameter...

discover-rutland.co.uk vulnerability

Vulnerable URL: http://www.discover-rutland.co.uk/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 1959404 Google Pagerank| 3 VIP website status:| No Check...

visittunbridgewells.com vulnerability

Vulnerable URL: http://www.visittunbridgewells.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 1410456 Google Pagerank| 2 VIP website status:| No Check...

visitsouthport.com vulnerability

Vulnerable URL: http://www.visitsouthport.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 702539 Google Pagerank| 5 VIP website status:| No Check...

padstowlive.com vulnerability

Vulnerable URL: http://www.padstowlive.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 2714434 Google Pagerank| 4 VIP website status:| No Check...

visitchester.com vulnerability

Vulnerable URL: http://www.visitchester.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 20.12.2015 Latest check for patch:| 20.12.2015 11:33 GMT Vulnerability status:| Publicly disclosed Alexa Rank| 753682 Google Pagerank| 5 VIP website...

greatcountrypubs.com vulnerability

Vulnerable URL: http://www.greatcountrypubs.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 20.12.2015 Latest check for patch:| 20.12.2015 11:33 GMT Vulnerability status:| Publicly disclosed Alexa Rank| 1278832 Google Pagerank| 4 VIP...

visitmaidstone.com vulnerability

Vulnerable URL: http://www.visitmaidstone.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 2505725 Google Pagerank| 3 VIP website status:| No Check...

visit-hampshire.co.uk vulnerability

Vulnerable URL: http://www.visit-hampshire.co.uk/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 465169 Google Pagerank| 4 VIP website status:| No Check...

visit1066country.com vulnerability

Vulnerable URL: http://www.visit1066country.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 1053687 Google Pagerank| 4 VIP website status:| No Check...

On (OAuth) token hijacks for fun and profit part #2 (Microsoft/xxx integration)

In a previous blogpost we have already analyzed a token hijack on one OAuth integration between some Microsoft and Google service and seen what went wrong. Now it is time to see yet another integration between Microsoft and xxxx unluckily I can't disclose the name of the other company due the fac...

Web Reference Database Open Redirect Vulnerability

Web Reference Database is a web-based multi-user interface product that provides search tools and automatic indexing for managing scientific literature. An open redirection vulnerability exists in the handling of the 'referrer' parameter of the Web Reference Database, which allows an attacker to...

vBSEO 3.6.0 functions_vbseo_hook.php Referer RCE

Remote command execution vulnerability in vBSEO functionsvbseohook.php Referer Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

ownCloud: apps.owncloud.com: XSS via referrer

Look at next request: Host: apps.owncloud.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:40.0 Gecko/20100101 Firefox/40.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer:...

WP Slimstat <= 4.1.5.2 - Referer Header Cross-Site Scripting (XSS)

The Slimstat Analytics WordPress plugin was affected by a Referer Header Cross-Site Scripting XSS security vulnerability...

GET to the vulnerability-vulnerability warning-the black bar safety net

This article is mainly about the current on the Internet get method is non-standard use of some of the security vulnerabilities. Which focuses on speaking the get request in the account login system is abuse of the scene and attacks. 0x01 Get method defined In between the client and server for...

Sendio ESP 'jsessionid' Information Disclosure Vulnerability

Sendio ESP Email Security Platform is a network appliance that provides anti-spam and anti-virus solutions for organizations from Sendio, USA. A security vulnerability exists in Sendio ESP versions prior to 7.2.4. Due to the presence of session identifiers in emails. A remote attacker can exploit...

CVE-2014-0999

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header...