282 matches found
Cross-site Scripting (XSS) - DOM in mineweb/minewebcms
✍️ Description A malicious actor is able to add a malicious payload as a new Navigation Bar Link Title, and after every time any users visit the main root page of the website, the XSS payload is executed and the session of whoever visits the site is compromised. 🕵️♂️ Proof of Concept 1; Create a...
Cross-site Scripting (XSS) - Stored in mineweb/minewebcms
Description A malicious actor is able to add a malicious payload as a new Page Title, and after every time any administrative user visits the /admin/pages route, the XSS payload is executed. Proof of Concept 1;Create a new Page at the following route: /admin/pages/add. Use the following payload a...
Cross-site Scripting (XSS) - Stored in fisharebest/webtrees
✍️ Description A malicious actor is able to add a malicious payload as a Family Tree Title, and after click the Family Tree nav button from the My Pages Menu, the XSS payload is executed. 🕵️♂️ Proof of Concept 1;Create a new family tree, either when logging in after install for the first time, or...
PT-2021-20268
Name of the Vulnerable Software and Affected Versions: NWDI Notification Service versions 7.31, 7.40, 7.50 Description: The issue arises from insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability. This allows a threat actor to send crafted scripts ...
FTAPI Cross-Site Scripting Vulnerability
FTAPI is an end-to-end encrypted file transfer and data room solution with unlimited file size. A cross-site scripting vulnerability exists in the "Background Image" upload function in the "Submit Box Template Editor" in FTAPI 4.0 - 4.10. An attacker can exploit this vulnerability by uploading an...
FTAPI SecuTransfer 跨站脚本漏洞
FTAPI is an end-to-end encrypted file transfer and data room solution with unlimited file size. A cross-site scripting vulnerability exists in the "Background Image" upload function in the "Submit Box Template Editor" in FTAPI 4.0 - 4.10. An attacker can exploit this vulnerability by uploading an...
CVE-2020-2005: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0...
PT-2020-15227
Name of the Vulnerable Software and Affected Versions Palo Alto Networks GlobalProtect Clientless VPN versions prior to 7.1.26 Palo Alto Networks GlobalProtect Clientless VPN versions prior to 8.0.21 Palo Alto Networks GlobalProtect Clientless VPN versions prior to 8.1.13 Palo Alto Networks...
CVE-2020-7575
A vulnerability has been identified in Climatix POL908 BACnet/IP module All versions, Climatix POL909 AWM module All versions V11.32. A persistent cross-site scripting XSS vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitra...
UBUNTU-CVE-2019-17068
PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content...
PoC Exploit Compromises Microsoft Live Accounts via Subdomain Hijacking
A proof-of-concept PoC attack details how an attacker can gain access a victim’s Microsoft Live webmail session, without having the person’s credentials. It relies upon the hijack of a Microsoft-owned Live.com website subdomain. The PoC, developed by CyberInt, demonstrates what it characterizes a...
CVE-2018-9080
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise...
CVE-2018-9080 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise...
CVE-2018-9080
CVE-2018-9080 affects certain Iomega/LenovoEMC NAS devices (firmware 4.1.402.34662 and earlier). The vulnerability allows session compromise via session fixation: an authenticated user’s session cookie can be manipulated by setting a known Iomega cookie value, after which the device fails to issu...
PT-2018-18841
Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier Description The issue allows an attacker to compromise a user's session by setting the Iomega cookie to a known value before logging into the NAS's web application,...
CVE-2018-9080: Improper Authentication
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise...
Anghami - Persistent Input Validation Vulnerability
Document Title: =============== Anghami - Persistent Input Validation Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2144 View Video: https://www.youtube.com/watch?v=7CnXLxs6CXo Release Date: ============= 2018-08-27 Vulnerability Laboratory ID VL-ID:...
CVE-2017-0921
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised...
CVE-2017-0921
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised...
