U.S. Dept Of Defense: RXSS - https://████████/

Hello All I Found RXSS in your OWN Website Steps To Reproduce Go to Those Links. https://██████/A'onerror=%22alert%601%60%22testabcd/ Browsers I test them on Firefox and Google Chrome. Fix:- Filter input on arrival Encode data on output Use appropriate response headers Content Security Policy...

Apache Tomcat Vulnerabilities Oct 2018 – Feb 2020

Summary Symantec SWG products using affected versions of Apache Tomcat may be susceptible to multiple vulnerabilities. A remote attacker can execute arbitrary code on the target host, hijack an authenticated Tomcat user's session, redirect a Tomcat user to an arbitrary URL, execute arbitrary...

OpenZ ERP 3.6.60 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: OpenZ ERP 3.6.60 - Persistent Cross-Site Scripting Vendor: https://www.openz.de/ https://www.openz.de/download.html Document Title: =============== OpenZ v3.6.60 ERP - Employee Persistent XSS Vulnerability Product & Service...

Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting Vendor: http://www.sentrifugo.com/ Link: http://www.sentrifugo.com/download Version: 3.2 Product & Service Introduction: ===============================...

OpenZ ERP 3.6.60 - Persistent Cross-Site Scripting

Exploit Title: OpenZ ERP 3.6.60 - Persistent Cross-Site Scripting Date: 2020-05-11 Exploit Author: Vulnerability-Lab Vendor: https://www.openz.de/ https://www.openz.de/download.html Document Title: =============== OpenZ v3.6.60 ERP - Employee Persistent XSS Vulnerability References Source:...

Pi-hole 4.4 Remote Code Execution / Privilege Escalation

!/usr/bin/env python3 Pi-hole = 4.4 RCE Author: Nick Frichette Homepage: https://frichetten.com Note: This exploit must be run with root privileges and port 80 must not be occupied. While it is possible to exploit this from a non standard port, for the sake of simplicity and not having to modify...

Create-Project Manager 1.07 Cross Site Scripting / HTML Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Create-Project Manager 1.07 Multi XSS /HTML injection Vunlerabilities Exploit Author: @ThelastVvV Vendor Homepage: https://codecanyon.net/item/create-project-manager-with-authenticator/20483329?srank=3 Version: 1.6 Tested on:...

WordPress Dosimple Theme 2.0 Cross Site Scripting

Document Title: =============== Wordpress Theme Dosimple v2.0 - XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2251 Release Date: ============= 2020-05-07 Vulnerability Laboratory ID VL-ID: ==================================== 225...

Qik Chat 3.0 Command Injection

Document Title: =============== Qik Chat v3.0 iOS - Name Command Inject Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2247 Release Date: ============= 2020-05-05 Vulnerability Laboratory ID VL-ID: ==================================== 224...

Helium: HTTP request Smuggling

When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being awa...

OpenZ ERP 3.6.60 Cross Site Scripting

Document Title: =============== OpenZ v3.6.60 ERP - Employee Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2234 Release Date: ============= 2020-05-06 Vulnerability Laboratory ID VL-ID: ====================================...

iChat 1.6 Cross Site Scripting

Exploit Title: iChat 1.6 XSS Vunlerability Google Dork:N/A Date: 2020-05-06 Exploit Author: @ThelastVvV Vendor Homepage: https://codecanyon.net/item/ichat-realtime-php-live-support-system/20758162?srank=2 Version: 1.6 Tested on: 5.4.0-kali4-amd64...

Create-Project Manager 1.07 Cross Site Scripting / HTML Injection

Exploit Title: Create-Project Manager 1.07 Multi XSS /HTML injection Vunlerabilities Google Dork:N/A Date: 2020-05-06 Exploit Author: @ThelastVvV Vendor Homepage: https://codecanyon.net/item/create-project-manager-with-authenticator/20483329?srank=3 Version: 1.6 Tested on: 5.4.0-kali4-amd64...

Tiny MySQL - Cross Site Scripting Vulnerability

Document Title: =============== Tiny MySQL - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2252 Release Date: ============= 2020-05-06 Vulnerability Laboratory ID VL-ID: ==================================== 2252 Comm...

Draytek VigorAP - (RADIUS) Persistent XSS Vulnerability

Document Title: =============== Draytek VigorAP - RADIUS Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2244 Release Date: ============= 2020-05-06 Vulnerability Laboratory ID VL-ID: ==================================== 224...

Brave Software: HTTP Request Smuggling

When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being awa...

OpenZ v3.6.60 ERP - Employee Persistent XSS Vulnerability

Document Title: =============== OpenZ v3.6.60 ERP - Employee Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2234 Release Date: ============= 2020-05-05 Vulnerability Laboratory ID VL-ID: ====================================...

Qik Chat v3.0 iOS - (Name) Command Inject Vulnerability

Document Title: =============== Qik Chat v3.0 iOS - Name Command Inject Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2247 Release Date: ============= 2020-05-04 Vulnerability Laboratory ID VL-ID: ==================================== 224...

CVE-2020-12624

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions...

CVE-2020-12624

CVE-2020-12624 affects The League application on Android prior to 2020-05-02. The flaw stems from reusing an OkHttp object, causing a bearer token in the HTTP Authorization header to be sent to an arbitrary external site hosting an image. This enables remote attackers to hijack sessions. Red Hat ...