CVE-2017-7284

An attacker that has hijacked a Unitrends Enterprise Backup before 9.1.2 web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover...

ASUS WRT Session Hijacking Nmap NSE Script

local http = require "http" local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local vulns = require "vulns" local nmap = require "nmap" description = ASUSWRT is a wireless router operating system that powers many routers produced by ASUS. Sessio...

CVE-2016-8789

Huawei eSpace Integrated Access Device IAD with software V300R001C03, V300R001C04, V300R001C06, V300R001C20, and V300R001C07 allows an attacker to trick a user into clicking a URL containing malicious scripts to obtain user information or hijack the session, aka XSS...

IBM Rational Rhapsody Design Manager HTML Injection Vulnerability

IBM Rational Rhapsody Design Manager is a set of collaborative design management software from IBM in the United States. IBM Rational Rhapsody Design Manager suffers from an HTML injection vulnerability. The vulnerability allows remote attackers to inject malicious script or HTML code, which can ...

Cross-site scripting vulnerability in Yzmcms frontend

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. Yzmcms frontend has cross-site scripting vulnerabilities. Attackers can insert malicious js code in the page to obtain user cookies an...

WordPress Core Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their weblogs on servers that support PHP and MySQL databases. A cross-site scripting vulnerability exists in WordPress Core versions prior to 4.7, which allows remote attackers to exploit the...

CVE-2017-6549

Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware before...

CVE-2017-6549

Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware before...

CVE-2017-6549

Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware before...

CVE-2017-6549

CVE-2017-6549 is a session hijack vulnerability in the httpd component of ASUSWRT firmware on multiple ASUS routers (e.g., RT-N56U/RT-N66U/RT-AC66U/RT-AC68U family, RT-AC53U, RT-N12, RT-AC5300, RT-N600, and Asuswrt-Merlin variants) with firmware older than the specified versions (pre 3.0.0.4.380....

UBUNTU-CVE-2016-10205

Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie...

PayPal PHP Merchant SDK Cross-Site Scripting Vulnerability

The PayPal PHP Merchant SDK is a development toolkit for integration with PayPal's Express Checkout and Web Payments Pro APIs. A cross-site scripting vulnerability in the GetAuthDetails.html.php file in the PayPal PHP Merchant SDK allows remote attackers to exploit the vulnerability to inject...

Apple iOS WebKit Component Cross-Site Scripting Vulnerability

Apple iOS is an operating system for mobile devices developed by Apple Inc. in the United States. A cross-site scripting vulnerability exists in the WebKit component of Apple iOS, which can be exploited by remote attackers to inject malicious script or HTML code that, when viewed with malicious...

U.S. Dept Of Defense: Cross-site scripting (XSS) on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @reptou was able to demonstrate this vulnerability by crafting a specially...

Oracle PeopleSoft HCM 9.2 Cross Site Scripting

Application: Oracle PeopleSoft Vendor: Oracle Bugs: XXS Reported: 31.10.2016 Vendor response: 1.11.2016 Date of Public Advisory: 17.01.2017 Reference: Oracle CPU Jan 2017 Authors: Vahagn Vardanyan, Dmitry Yudin 1. ADVISORY INFORMATION Title: Oracle PeopleSoft a XSS vulnerability Advisory ID:...

DEBIAN-CVE-2016-7980

Cross-site request forgery CSRF vulnerability in ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted validerxml request. NOTE: this issue can be combin...

Juniper Junos Cross-Site Scripting Vulnerability (CNVD-2017-00608)

Juniper Junos is a network operating system dedicated to the company's hardware systems. Cross-site scripting exists in the Juniper Junos Space WEB management interface, which allows remote attackers to exploit vulnerabilities to inject malicious script or HTML code that can be used to gain acces...

D-Link DGS-1100 Switch Local Hardcoded SSL Certificate Vulnerability

The D-Link DGS-1100 is an Ethernet switch from AUO D-Link. A security vulnerability exists in D-Link DGS-1100 devices using firmware version 1.01.018, which originates from a program using a hard-coded SSL private key. An attacker can exploit the vulnerability by hijacking an HTTPS session to...

CVE-2016-10125

D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, which allows man-in-the-middle attackers to spoof devices by hijacking an HTTPS session...

CVE-2016-6854

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwant...