jspxcms admin backend login page cross-site scripting vulnerability

jspxcms is an open source, Java-based content management system CMS. A cross-site scripting vulnerability exists in the administration backend login page of jspxcms version v5.2.4, due to analyzing the search box on the front page of Jspxcms for user inputs that are not input filtered. This...

Informatica: [now.informatica.com] Reflective XSS

XSS vulnerability lies on http://now.informatica.com/launch-next-bigdata-registration-inxpo.html?Source=homepage POC Sign up for big data management Virtual launch event on parameter companyname inject '"...

Shopify: Reflective XSS on wholesale.shopify.com

There is a reflected XSS issue on wholesale.shopify.com Steps to reproduce: Call the following URL in Mozilla Firefox: https://wholesale.shopify.com/asd%27%3Balert%28%27XSS%27%29%3B%27 An alert box with "XSS" appears. This means that an attacker has full control of the scripts, that are executed ...

CVE-2015-5076 - Vulnerability title: Reflective XSS In X2Engine Inc. X2Engine

Vulnerability title: Reflective XSS In X2Engine Inc. X2Engine CVE: CVE-2015-5076 Vendor: X2Engine Inc. Product: X2Engine Affected version: 4.2 Fixed version: 5.2 Reported by: Simone Quatrini Details: It was discovered that the web application was vulnerable to reflective Cross-Site Scripting wher...

CVE-2015-7320 - Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin

Vulnerability title: Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin CVE: CVE-2015-7320 Vendor: WordPress DWBooster Product: Appointment Booking Calendar Affected version: 1.1.7 Fixed version: 1.1.8 Reported by: Iberia Medeiros Vulnerability Details:...

Mail.ru: Reflective Xss on news.mail.ru and admin.news.mail.ru

Hello folks I know this is out of scope for a bounty but I thought I'd report it anyway. The XSS appears in the date parameter and there are two examples below. https://news.mail.ru/currency.html?date=%22%3E%3Csvg%3E%3Cscript%3E/%3C@/%3Eprompt%28document.domain,document.cookie%29%3C/script%3E...

jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

Two cross-site scripting XSS flaws were found in Jenkins. A remote attacker could use these flaws to conduct XSS attacks against users of an application using Jenkins...

WordPress Appointment Booking Calendar 1.1.7 XSS Vulnerability

WordPress Appointment Booking Calendar plugin version 1.1.7 suffers from multiple cross site scripting vulnerabilities. Vulnerability title: Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin CVE: CVE-2015-7320 Vendor: WordPress DWBooster Product: Appointment Booking...

jQuery Mobile Docs 1.2.0 final XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: jQuery Mobile Docs 1.2.0 final XSS Reflected Software Link: http://demos.jquerymobile.com/1.2.1/ Exploit Author: Andrei Manole Contact: email protected Tested On : Windows FireFox CVE : N/A Category: webapps Date: 05/09/2015 1...

InVision: Reflective XSS in projects.invisionapp.com

I discovered a vulnerability in the commenting system, when you leave a comment with and click post comment it will trigger an alert. I will be including a video to help understand this vulnerability...

Informatica: [now.informatica.com] Reflective Xss

http://now.informatica.com/endata-integration-for-dummiesbook2642.html?source=Homepage The issue is located here. I will be including a video demonstrating this vulnerability Xss vector used: xs...

FreeBSD : jenkins -- multiple vulnerabilities (22dc4a22-d1e5-11e4-879c-00e0814cab4e)

Jenkins Security Advisory : DescriptionSECURITY-171, SECURITY-177 Reflective XSS vulnerability An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory: Description SECURITY-171, SECURITY-177 Reflective XSS vulnerability An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls...

Qibo Information V1 /search.php 跨站脚本漏洞

/search.php$moduleselect="select name='mid' onChange="window.location.href='?mid='+this.optionsthis.selectedIndex.value"option value='0' style='color:aaa;'所有模型/option"; foreach$moduledb AS $key=$value $ckk=$mid==$key?' selected ':' '; $moduleselect.="option value='$key' $ckk$value/option";...

Arris Touchstone TG862G/CT Cross Site Scripting

----------- Vendor: ----------- Arris Interactive, LLC http://www.arrisi.com/ ISP: Comcast Xfinity ----------------------------------------- Affected Products/Versions: ----------------------------------------- HW: Arris Touchstone TG862G/CT Xfinity branded SW: Version 7.6.59S.CT Tested...

WordPress Better Search Plugin <= 1.3.4 - Reflective XSS

This plugin is prone to a reflective cross site scripting vulnerability. Solution Update the plugin...

Epicor Enterprise 7.4 - Multiple Vulnerabilities

Epicor suffers from cross site scripting and password disclosure vulnerabilities. "Epicor Enterprise vulnerabilities" - Affected vendor: Epicor Software Corporation - Affected system: Epicor Enterprise - Version 7.4 - Vendor disclosure date: May 13th, 2014 - Public disclosure date: September 30th...

Nagios XI < 2011R1.9 Multiple Vulnerabilities

Binary data 8363.prm...

MyConnection Server (MCS) 9.7i Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Author: 1N3 Website: http://treadstonesecurity.blogspot.ca Vender Website: http://www.visualware.com/ Affected Product: MyConnection Server Affected Version: 9.7i others may also be vulnerable ABOUT: MyConnection Server MCS delivers a broad...

MyConnection Server (MCS) 9.7i Cross Site Scripting

Author: 1N3 Website: http://treadstonesecurity.blogspot.ca Vender Website: http://www.visualware.com/ Affected Product: MyConnection Server Affected Version: 9.7i others may also be vulnerable ABOUT: MyConnection Server MCS delivers a broad range of support managed automated and user initiated...