Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities

Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities Exploit Title: Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities Discovery Date: 2018-12-05 Exploit Author: Gionathan "John" Reale Vendor Homepage: https://www.vembu.com/ Software Link : N/A Google Dork: N/A Version: 4.4....

Vembu Storegrid Web Interface 4.4.0 Cross Site Scripting / Information Disclosure

Exploit Title: Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities Discovery Date: 2018-12-05 Exploit Author: Gionathan "John" Reale Vendor Homepage: https://www.vembu.com/ Software Link : N/A Google Dork: N/A Version: 4.4.0 CVE : CVE-2014-10078,CVE-2014-10079 Description StoreGrid...

Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities

Exploit Title: Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities Discovery Date: 2018-12-05 Exploit Author: Gionathan "John" Reale Vendor Homepage: https://www.vembu.com/ Software Link : N/A Google Dork: N/A Version: 4.4.0 CVE : CVE-2014-10078,CVE-2014-10079 Description StoreGrid...

CVE-2019-7172

A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/core/users/admins/myedit.php...

CVE-2019-7173

Croogo is affected by a stored-self XSS vulnerability in the title field of the Attachment page (/admin/file-manager/attachments/edit/4). Affected versions include Croogo prior to 3.0.7 (v3.0.5 referenced; OSV notes vulnerability before 3.0.7). The root cause is reflected in multiple sources desc...

CVE-2019-7170

Affected software: Croogo CMS (versions up to 3.0.5). Vulnerability: Stored-self XSS in the article/title handling, exploitable via the vulnerable Title field submitted to /admin/taxonomy/vocabularies. Impact (as stated): Attacker can execute HTML/JavaScript in a victim’s browser. Root cause (as ...

CVE-2019-6992

CVE-2019-6992 is a stored-self XSS in ZoneMinder up to version 1.32.3, via web/skins/classic/views/controlcaps.php. An attacker can inject HTML/JavaScript by exploiting a long NAME or PROTOCOL in index.php?view=controlcaps, resulting in code execution in the vulnerable field. Exploitation details...

CVE-2019-6990

CVE-2019-6990 is a stored-self XSS in ZoneMinder up to version 1.32.3, triggered via a crafted Zone NAME in the URL index.php?view=zones&action=zoneImage&mid=1. The vulnerability affects web/skins/classic/views/zones.php. Exploitation could allow HTML/JavaScript execution in the vulnerable field....

U.S. Dept Of Defense: Self XSS combine CSRF at https://████████/index.php

Hi Team, I found that https://█████████/index.php has vulnerability by XSS in arg2 parameter. Anyway there is no csrf token tied with the post request. As a result this csrf flaw can make the self-xss as a global reflected xss. CSRF to XSS PoC history.pushState'', '', '/' You just need to copy an...

CVE-2018-18716

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability...

CVE-2018-18716

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability...

Cross site scripting

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability...

CVE-2018-18716

CVE-2018-18716 affects Zoho ManageEngine OpManager 12.3 before 123219, with a Self XSS vulnerability in OpManager’s web interface. Connected CNVD/CVE records corroborate a Cross-Site Scripting issue for OpManager 12.3. The documents do not specify exact exploit steps, vectors beyond the self-XSS ...

CVE-2018-18716

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability...

CVE-2018-9081

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content...

CVE-2018-9081

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content...

CVE-2018-9081

CVE-2018-9081 affects Iomega, LenovoEMC NAS devices (4.1.402.34662 and earlier) with Content Viewer assets vulnerability enabling self-XSS via file names. Attackers could chain vulnerabilities (token theft, CSRF) to gain unauthorized shell access or escalate privilege on affected devices, impacti...

CVE-2018-9081 Iomega and LenovoEMC NAS Web UI Vulnerabilities

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content...

CVE-2017-15427

Removed by vendor...

PortSwigger Web Security: Browser Self XSS Protection not implemented

Hi Self XSS Protection not used ,An attacker can trick users to insert JavaScript in browser console. A Self-XSS scam usually works by promising to help you access somebody else's account. Instead, the scammer tricks you into gaining access to your account for fraud, spam and tricking more people...