U.S. Dept Of Defense: Cross-site scripting (XSS) on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @reptou was able to demonstrate this vulnerability by crafting a specially...

Oracle PeopleSoft HCM 9.2 Cross Site Scripting

Application: Oracle PeopleSoft Vendor: Oracle Bugs: XXS Reported: 31.10.2016 Vendor response: 1.11.2016 Date of Public Advisory: 17.01.2017 Reference: Oracle CPU Jan 2017 Authors: Vahagn Vardanyan, Dmitry Yudin 1. ADVISORY INFORMATION Title: Oracle PeopleSoft a XSS vulnerability Advisory ID:...

DEBIAN-CVE-2016-7980

Cross-site request forgery CSRF vulnerability in ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted validerxml request. NOTE: this issue can be combin...

Juniper Junos Cross-Site Scripting Vulnerability (CNVD-2017-00608)

Juniper Junos is a network operating system dedicated to the company's hardware systems. Cross-site scripting exists in the Juniper Junos Space WEB management interface, which allows remote attackers to exploit vulnerabilities to inject malicious script or HTML code that can be used to gain acces...

D-Link DGS-1100 Switch Local Hardcoded SSL Certificate Vulnerability

The D-Link DGS-1100 is an Ethernet switch from AUO D-Link. A security vulnerability exists in D-Link DGS-1100 devices using firmware version 1.01.018, which originates from a program using a hard-coded SSL private key. An attacker can exploit the vulnerability by hijacking an HTTPS session to...

CVE-2016-10125

D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, which allows man-in-the-middle attackers to spoof devices by hijacking an HTTPS session...

CVE-2016-6854

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwant...

CVE-2016-6851

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be execute...

CVE-2016-6847

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as mp3 album covers. In case their XML structure contains script code, that code may get executed when calling the related cover URL. Malicious script code can be executed within a user's context. This c...

CVE-2016-6844

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within SVG files is maintained when opening such files "in browser" based on our Mail or Drive app. In case of "a" tags, this may include link targets with base64 encoded "data" references. Malicious script code c...

CVE-2016-5740

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical attachments within scheduling E-Mails. This content, for example an appointment's location, will be presented to the user at the E-Mail App, depending on the invitation workflow. Th...

CVE-2016-3173

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...

CVE-2016-2878

Multiple cross-site request forgery CSRF vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2016-3009

Cross-site request forgery CSRF vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the Connections generic page...

Security Advisory - XSS Vulnerability in Huawei eSpace IAD

Huawei eSpace Integrated Access Device IAD has a reflected cross-site scripting XSS vulnerability. An attacker could trick a user into clicking a URL containing malicious scripts. Then the user's browser may receive a response from the eSpace IAD and execute the malicious scripts. Successful...

Cross-site Scripting Vulnerability in ZhengTong Content Management System

The GovContent Management System is a website management system designed and built on the JAVA EE platform, which is mainly used for the website construction and management of government agencies, enterprises and institutions. A cross-site scripting vulnerability exists in the CMS. The...

Cisco IP Interoperability and Collaboration System Cross-Site Scripting Vulnerability

The Cisco IP Interoperability and Collaboration System is a set of solutions that provide voice interoperability across different systems based on IP standards. A cross-site scripting vulnerability exists in Cisco IP Interoperability and Collaboration System Universal Media Services, which can be...

CVE-2016-9028 - Unauthorized Redirect flaw in Citrix NetScaler ADC could result in session hijack

Description of Problem An unauthorized redirect vulnerability has been identified in Citrix NetScaler ADC in the AAA-TM flow that could allow a remote attacker to obtain session cookies of a redirected AAA user. This vulnerability does not impact NetScaler Gateway. The following vulnerability has...

XSS Vulnerability in NetEase Mail Master Client Android Version

NetEase Mail Master client is a universal email client launched by NetEase 163. An XSS vulnerability exists in the Android version Ver4.14.1 of the NetEase Mail Master client. It allows attackers to insert malicious js code into the page to obtain user cookies and other information, leading to us...

Cisco Host Scan HostScan Engine Cross-Site Scripting Vulnerability

Cisco Adaptive Security Appliances Web VPN is a set of modules for configuring Web VPN on ASA firewalls. A cross-site scripting vulnerability in the HostScan Engine in the Cisco Host Scan package used by Cisco Adaptive Security Appliances Web VPN allows remote attackers to exploit the vulnerabili...