IBM Integration Bus Session Hijacking Vulnerability

IBM Integration Bus formerly known as IBM WebSphere Message Broker is an enterprise service bus ESB product from IBM. The product provides connectivity and common data transformations for Service Oriented Architecture SOA environments and non-SOA environments. A session hijacking vulnerability...

CentOS Web Panel v0.9.8.12 - Multiple Persistent Web Vulnerabilities

Exploit for linux platform in category web applications Document Title: =============== CentOS Web Panel v0.9.8.12 - Multiple Persistent Web Vulnerabilities Vulnerability Class: ==================== Cross Site Scripting - Persistent Current Estimated Price: ======================== 1.000€ - 2.000...

CVE-2017-11398

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system...

Spoofing

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system...

CVE-2017-11398

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system...

CVE-2017-11398

CVE-2017-11398 affects Trend Micro Smart Protection Server (Standalone)

CVE-2017-11398

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system...

CVE-2017-1693

IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small timeframe before the session times out. IBM X-Force ID: 134164...

Reservo Image Hosting Script 1.5 - Cross-Site Scripting

Exploit Title: Reservo Image Hosting Script 1.5 - Cross Site Scripting Date: 15-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: reservo.co Version: 1.6 CVE-ID: CVE-2018-5705 With support for automatic thumbnails & image resizing in over 200...

Reservo Image Hosting Script 1.5 Cross Site Scripting

Exploit Title: Reservo Image Hosting Script 1.5 - Cross Site Scripting Date: 15-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: reservo.co Version: 1.6 CVE-ID: CVE-2018-5705 With support for automatic thumbnails & image resizing in over 200...

CVE-2018-5479

FoxSash ImgHosting 1.5 according to footer information is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By...

Multiple Aztech Modem Router Products Session Hijacking Vulnerability

Aztech Modem Routers is an all-in-one modem and router product from the Aztech group of companies in Singapore. A session hijacking vulnerability exists in multiple Aztech Modem Routers products. An attacker could exploit this vulnerability to gain access to affected devices...

ImgHosting 1.5 - Cross-Site Scripting

Exploit Title: ImgHosting Image Storage System 1.5 - Cross-Site-Scripting Date: 12-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: foxsash.com Version: 1.5 CVE-ID: CVE-2018-5479 ImgHosting – Image Storage System quick and easy image hosting...

Magento Connect T1 Cross Site Scripting

Document Title: =============== Magento Connect T1 - Claim Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1469 Release Date: ============= 2018-01-08 Vulnerability Laboratory ID VL-ID: ==================================== 1469...

Zomato: Zomato.com Reflected Cross Site Scripting

zomato.com/php/liveSuggest.php takes various field input to show customized out put for the users. The data entered to entityid field is not santized or html encoded which allows user to add payloads via this parameter which will be reflected to user. Steps to reproduce : Please click on below li...

Adobe CreativeCloud (Webform) - Persistent Vulnerability

Document Title: =============== Adobe CreativeCloud Webform - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1848 Release Date: ============= 2018-01-04 Vulnerability Laboratory ID VL-ID: ==================================== 184...

Session Hijacking Through Lack Of HTTPOnly Flag

spree is vulnerable to session hijacking attacks. The vulnerability exists due to the lack of HttpOnly flag in the HTTP headers...

Critical "Same Origin Policy" Bypass Flaw Found in Samsung Android Browser

A critical vulnerability has been discovered in the browser app comes pre-installed on hundreds of millions of Samsung Android devices that could allow an attacker to steal data from browser tabs if the user visits an attacker-controlled site. Identified as CVE-2017-17692, the vulnerability is Sa...

Schneider Electric Pelco VideoXpert Enterprise Directory Traversal Vulnerability

Pelco VideoXpert Enterprise is an enterprise video management system. A directory traversal vulnerability exists in Schneider Electric Pelco VideoXpert Enterprise, which allows an unauthorized attacker to perform a directory traversal attack that could lead to authentication bypass or session...

Open Ticket Request System Session Hijacking Vulnerability

Open Ticket Request System OTRS is an open source defect tracking and management system software from the German OTRS Group. The software categorizes service requests submitted through various channels such as phone calls, emails, etc. into different queues and service levels, and the service...