1276 matches found
CVE-2018-19774
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "PresentSpace.jsp" has reflected XSS via the GroupId and ConnPoolName parameters...
CVE-2018-19774
CVE-2018-19774 affects InfoVista VistaPortal SE 5.1 (build 51029). The PresentSpace.jsp page is vulnerable to reflected Cross-Site Scripting via the GroupId and ConnPoolName parameters. According to NVD, the vulnerability has CVSS v3.0 base metrics: Network attack vector, Low attack complexity, N...
CVE-2018-19811
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "/VPortal/mgtconsole/Import.jsp" has reflected XSS via the ConnPoolName parameter...
CVE-2018-19774
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "PresentSpace.jsp" has reflected XSS via the GroupId and ConnPoolName parameters...
CVE-2018-19771
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 build 51029. The page "EditCurrentPool.jsp" has reflected XSS via the PropName parameter...
hibernate-validator: Privilege escalation when running under the security manager
It was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an...
hibernate-validator: Privilege escalation when running under the security manager
It was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an...
PowerSploit
This is an offensive tool for Windows PowerShell exploitation. It is a collection of PowerShell scripts that can be used to exploit vulnerabilities in Windows systems. The repository contains several modules, including AntivirusBypass, CodeExecution, and others. The AntivirusBypass module contain...
Multiple vulnerabilities in jspxcms
jspxcms is an open source content management system based on java and jsp technology . jspxcms cross-site request forgery and reflective cross-site scripting vulnerabilities. Attackers can use the vulnerability to send scripts containing malicious links , to be reviewed by the administrator can b...
sRDI - Shellcode Implementation Of Reflective DLL Injection
sRDI allows for the conversion of DLL files to position independent shellcode. Functionality is accomplished via two components: C project which compiles a PE loader implementation RDI to shellcode Conversion code which attaches the DLL, RDI, and user data together with a bootstrap This project i...
Joomla! cross-site scripting vulnerability (CNVD-2018-17882)
Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A reflective cross-site scripting vulnerability exists in the language switching...
CVE-2018-12711
An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the...
CVE-2018-12711
CVE-2018-12711 affects Joomla! language switcher module (versions 1.6.0–3.8.8). The issue is a reflective XSS caused by unescaped HTML characters in the current language link, which can be exploited to inject arbitrary parameters/values on the current page URL. The vulnerability is tied to the la...
Security Bulletin: Multiple security exposures in IBM Cognos BI Server (CVE-2013-6954, CVE-2013-6732, CVE-2013-5802, CVE-2013-5825, CVE-2014-0854, CVE-2014-0861)
Summary IBM Cognos BI Server is affected by multiple security exposures. Vulnerability Details CVE ID: CVE-2013-6954 DESCRIPTION: If an attacker is able to upload a specially-crafted image to the IBM Cognos BI Server and have the application process it, they may be able to cause the application t...
OLX: Reflective XSS at olx.ph
Hello, I would like to report a reflective XSS at https://www.olx.ph. Steps to reproduce Visit the following link: https://www.olx.ph/all-results?q=car&utmsource=OptHomepageVar0&utmmedium=Search&utmcampaign=toto%27-alertdocument.domain-%27-%27 An XSS should pop-up F305078 Technical Details The...
Malwarebytes CrackMe 2: contest summary
About three weeks ago, we published our second CrackMe. It triggered a lot of interest, and we got many high-quality write-ups. Choosing the winner was really difficult! In this post, I am going to summarize the contest and comment on the received submissions. CrackMe 2 challenge The topic of the...
[20180602] - Core - XSS vulnerability in language switcher module
In some cases the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page url...
Windows WMI Recieve Notification Exploit
This Metasploit module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. This Metasploit module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. This module requires Metasploit: http://metasploit.com/download Current source:...
Use the password reset functions to achieve account-hijacking-vulnerability warning-the black bar safety net
Recently, I attended a platform to invite vulnerability testing project, in which the discovery of a unique account hijacking vulnerability, the entire vulnerability discovery process very unexpected but also very lucky, by the password reset function can be achieved account hijacking, and I will...
