aleksei.su XSS vulnerability

Vulnerable URL: http://aleksei.su/search/index.html?a=0="%3Cscript%3Ealert%28%2FXSSPOSED%2F%29%3B%3C%2Fscript%3E&=%3Cscript%3Ealert%28%2Folololkin%2F%29%3B%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability...

it.eurosport.com XSS vulnerability

Vulnerable URL: http://it.eurosport.com/search/search?q=%27%2Falert%28%2FXSSPOSED%2F%29%2F%27=it-eurosport-com=it-eurosport-com=it-eurosport-com=p=xmlnodtd=date%3AD%3AL%3Ad1=200mc=1=UTF-8=UTF-8=1apps=1=en==%28availableOn%3A%7CavailableOn%3Aall%29=4=it.eurosport.com Details: Description| Value...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/home/homepage/search in the web app in Adobe Connect before 9.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

hensel-electric.de XSS vulnerability

Open Bug Bounty ID: OBB-62859 Description| Value ---|--- Affected Website:| hensel-electric.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

royal-painting.com XSS vulnerability

Open Bug Bounty ID: OBB-62295 Description| Value ---|--- Affected Website:| royal-painting.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

ElasticSearch Search Groovy Sandbox Bypass Exploit

This Metasploit module exploits a remote command execution RCE vulnerability in ElasticSearch, exploitable by default on ElasticSearch prior to 1.4.3. The bug is found in the REST API, which does not require authentication, where the search function allows groovy code execution and its sandbox ca...

Member of confluence-administrators group able to see restricted page in pagetree, quick search and navigation panel

Bug Background Confluence super-users or member of confluence-administrators group should be able to access any content in Confluence including restricted content as long as it have the direct URL to access as describe in our documentation...

Cross site scripting

Cross-site scripting XSS vulnerability in module/search/function.php in Ganesha Digital Library GDL 4.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a ByEge action...

PT-2015-3533

Name of the Vulnerable Software and Affected Versions AJAX Post Search cardoza-ajax-search plugin versions prior to 1.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the srch txt parameter in a "the search text" action to the...

WordPress Plugin AJAX Post Search 'the_search_function' SQL Injection Vulnerability

WordPress is a content management system developed using the PHP language. WordPress plugin AJAX Post Search 'thesearchfunction' suffers from a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the 'thesearchtext' parameter...

Typo3 JobControl 2.14.0 - Cross Site Scripting / SQL Injection

No description provided by source. Mogwai Security Advisory MSA-2014-02 ---------------------------------------------------------------------- Title: JobControl dmmjobcontrol Multiple Vulnerabilities Product: dmmjobcontrol Typo3 Extension Affected versions: 2.14.0 Impact: high Remote: yes Product...

CVE-2014-7201

Multiple SQL injection vulnerabilities in the search function in pi1/class.txdmmjobcontrolpi1.php in the JobControl dmmjobcontrol extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the 1 education, 2 region, or 3 sector fields, as demonstrated by t...

CVE-2014-7201

Multiple SQL injection vulnerabilities in the search function in pi1/class.txdmmjobcontrolpi1.php in the JobControl dmmjobcontrol extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the 1 education, 2 region, or 3 sector fields, as demonstrated by t...

CVE-2014-7201

Multiple SQL injection vulnerabilities in the search function in pi1/class.txdmmjobcontrolpi1.php in the JobControl dmmjobcontrol extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the 1 education, 2 region, or 3 sector fields, as demonstrated by t...

CVE-2014-7201: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the search function in pi1/class.txdmmjobcontrolpi1.php in the JobControl dmmjobcontrol extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the 1 education, 2 region, or 3 sector fields, as demonstrated by t...

Privilege escalation

The Outlook Extension in IBM Content Collector 4.0.0.x before 4.0.0.0-ICC-OE-IF004 allows local users to bypass the intended Reviewer privilege requirement and read e-mail messages from an arbitrary mailbox by invoking the Search function...

CVE-2014-4757

CVE-2014-4757 affects the Outlook Extension in IBM Content Collector (version 4.0.0.x) prior to 4.0.0.0-ICC-OE-IF004. The issue lets local users bypass the Reviewer privilege and read e-mail messages from an arbitrary mailbox by invoking the Search function. The NVD entry lists a low severity (CV...

CVE-2014-4757

The Outlook Extension in IBM Content Collector 4.0.0.x before 4.0.0.0-ICC-OE-IF004 allows local users to bypass the intended Reviewer privilege requirement and read e-mail messages from an arbitrary mailbox by invoking the Search function...

PT-2014-6099

Name of the Vulnerable Software and Affected Versions IBM Content Collector versions 4.0.0.x before 4.0.0.0-ICC-OE-IF004 Description The issue allows local users to bypass the intended Reviewer privilege requirement and read e-mail messages from an arbitrary mailbox by invoking the Search functio...

myprivatetutor.my XSS vulnerability

Open Bug Bounty ID: OBB-47167 Description| Value ---|--- Affected Website:| myprivatetutor.my Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...