PT-2020-9340

Name of the Vulnerable Software and Affected Versions: Verint Impact 360 version 15.1 Description: An issue was discovered that allows attackers to potentially compromise valid credentials. At the /wfo/control/signin API endpoint, the rd parameter can accept a URL, to which users will be redirect...

CVE-2019-12784: Cross-Site Request Forgery (CSRF)

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and...

CVE-2019-12783: URL Redirection to Untrusted Site

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which users will be redirected after a successful login. In conjunction with CVE-2019-12784, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site,...

Jelastic 5.4 - 'host' SQL Injection

Exploit Title: Jelastic 5.4 - 'host' SQL injection Google Dork: N/A Date: date Exploit Author: Procode701 Vendor Homepage: https://jelastic.com/ Software Link: https://jelastic.com/ Version: 5.4 Tested on: Kali Linux CVE : N/A POC: The application /1.0/users/authentication/rest/signin is vulnerab...

Mitel ST 14.2 Cross-Site Scripting Vulnerability

Mitel ST is a video conferencing product from Mitel Canada. conferencing is one of the teleconferencing components. A cross-site scripting vulnerability exists in the conferencing component of Mitel ST 14.2 GA29 19.49.9400.0 and prior versions, which stems from the program failing to adequately...

CVE-2018-12901

A vulnerability in the conferencing component of Mitel ST 14.2, versions GA29 19.49.9400.0 and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation for the signin.php page. A successful exploit could allow an attack...

CVE-2018-12901

A vulnerability in the conferencing component of Mitel ST 14.2, versions GA29 19.49.9400.0 and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation for the signin.php page. A successful exploit could allow an attack...

Mitel MiVoice Connect Cross-Site Scripting Vulnerability (CNVD-2018-08581)

Mitel MiVoice Connect R1707-PREM and Mitel ST are both products of Mitel Canada.Mitel MiVoice Connect R1707-PREM is a Unified Communications Management Appliance.ST is a videoconferencing product.conferencing is one of the notification components. conferencing is one of the conference notificatio...

CVE-2018-9103

A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 21.84.5535.0 and earlier, and Mitel ST 14.2, versions GA27 19.49.5200.0 and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient...

CVE-2018-9103

A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 21.84.5535.0 and earlier, and Mitel ST 14.2, versions GA27 19.49.5200.0 and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient...

PT-2018-18851

Name of the Vulnerable Software and Affected Versions Mitel MiVoice Connect versions R1707-PREM SP1 21.84.5535.0 and earlier Mitel ST 14.2 versions GA27 19.49.5200.0 and earlier Description The issue is related to insufficient input validation for the signin interface, which could allow an...

CVE-2018-9102: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 21.84.5535.0 and earlier, and Mitel ST 14.2, versions GA27 19.49.5200.0 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for...

shopbop.com XSS vulnerability

Open Bug Bounty ID: OBB-575459 Description| Value ---|--- Affected Website:| shopbop.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure...

davidoff.menshealth.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-533357 Description| Value ---|--- Affected Website:| davidoff.menshealth.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

smashbox.com XSS vulnerability

Vulnerable URL: https://www.smashbox.com/account/signin.tmpl?SUBMIT="%3E%3Csvg onload = promptOPENBUGBOUNTY%0A \ Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 92904 VIP website status:| No Check smashbox.com SS...

CVE-2016-4740

Apple iOS before 10, when Handoff for Messages is used, does not ensure that a Messages signin has occurred before displaying messages, which might allow attackers to obtain sensitive information via unspecified vectors...

varecha.com XSS vulnerability

Vulnerable URL: http://www.varecha.com/fb/signin.php?w=Basica75iy%22%3E%3Cscript%3Ealert/OPENBUGBOUNTY/%3C/script%3Etar6b Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / N...

rahnama.com XSS vulnerability

Vulnerable URL: http://www.rahnama.com/user/signin/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6646 VIP website status:| Yes Check rahnama.com SSL connection:| Grade: B+...

signin.verizon.com XSS vulnerability

Vulnerable URL: https://signin.verizon.com/sso/authsso/loginProcess.jsp?target=javascript:alert/OPENBUGBOUNTY/ Details: Description| Value ---|--- Patched:| Yes, at 26.09.2017 Latest check for patch:| 26.09.2017 05:23 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

ohmyzip.com XSS vulnerability

Vulnerable URL: https://www.ohmyzip.com/account/signin?ret=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 12052 VIP website status:| Yes Check ohmyzip.com SSL connection:| Grade:...