CVE-2015-2083

Cross-site request forgery CSRF vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields request to admin.php...

IBM Tivoli Endpoint Manager Web Reports Component Cross-Site Scripting Vulnerability

IBM Tivoli Endpoint Manager provides a unified, real-time visualization and implementation approach to deploying and managing patches to all endpoints. A cross-site scripting vulnerability in the Web Reports component of IBM Tivoli Endpoint Manager version 9.1.1229 prior to 9.1 can be exploited b...

Drupal Panopoly Magic Module Cross-Site Scripting Vulnerability

Drupal is an open source content management platform. A cross-site scripting vulnerability exists in Drupal Panopoly Magic Module, which allows remote attackers to exploit this vulnerability to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive...

Drupal Navigate module cross-site scripting vulnerability

Drupal is an open source content management platform. A cross-site scripting vulnerability exists in the Drupal Navigate module, which allows remote attackers to exploit this vulnerability to construct malicious URIs that can be tricked into being parsed by the user, which can be used to obtain...

Cosmoshop 'index.cgi' Cross-Site Scripting Vulnerability

Cosmoshop is an online store application. A cross-site scripting vulnerability exists in Cosmoshop 'index.cgi', which can be exploited by remote attackers to construct malicious URIs that can be tricked into being parsed by the user, which can be used to obtain sensitive cookies, hijack sessions,...

Multiple Cross-Site Scripting Vulnerabilities in Cit-e-Net Cit-e-Access

Cit-e-Net Cit-e-Access is a WEB-based application. Cit-e-Net Cit-e-Access has multiple cross-site scripts, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions, or perform malicious...

vBulletin Forum Component 'forum/help' Page Cross-Site Scripting Vulnerability

vBulletin is the United States Internet Brands and vBulletin Solutions, Inc. jointly developed an open source commercial Web forum program . Forum is one of the forum components . A cross-site scripting vulnerability exists in vBulletin, which allows remote attackers to exploit the vulnerability ...

Cisco Web Security Appliance Cross-Site Scripting Vulnerability

The Cisco Web Security Appliance is a secure Web gateway that integrates malware protection, application visualization control, policy control, and more in one platform. A cross-site scripting vulnerability exists in the Cisco Web Security Appliance, which allows remote attackers to exploit this...

IBM Tivoli Endpoint Manager HTML Injection Vulnerability

IBM Tivoli Endpoint Manager provides a unified, real-time visualization and implementation approach to deploying and managing patches to all endpoints. IBM Tivoli Endpoint Manager failed to properly filter user-submitted input, allowing remote attackers to exploit vulnerabilities to inject...

ovirt-engine-webadmin: HttpOnly flag is not included when the session ID is set

It was found that the oVirt web admin interface did not include the HttpOnly flag when setting session IDs with the Set-Cookie header. This flaw could make it is easier for a remote attacker to hijack an oVirt web admin session by leveraging a cross-site scripting XSS vulnerability...

Unspecified Cross-Site Scripting Vulnerability in PerlTreeBBS

PerlTreeBBS is a BBS application. PerlTreeBBS suffers from an unspecified cross-site scripting vulnerability that can be exploited by remote attackers to construct malicious URIs, trick users into parsing them, obtain sensitive cookies, hijack sessions, or perform malicious operations on the clie...

WordPress Plugin Easing Slider Has Multiple Cross-Site Scripting Vulnerabilities

WordPress is a use of PHP language development of blogging platform , users can support PHP and MySQL database server to set up their own weblog . WordPress Easing Slider Plugin is a wordpress-based plugin . WordPress Easing Slider Plugin has multiple cross-site scripting vulnerabilities that can...

Multiple Cross-Site Scripting Vulnerabilities in Apache ActiveMQ

Apache ActiveMQ is an open source message bus that supports JMS1.1 and J2EE 1.4 specification of the JMS Provider implementation . Apache ActiveMQ WEB-based management console multiple instances of cross-site scripting vulnerabilities , remote attackers can exploit the vulnerability to build...

OptimalSite CMS 'display_dialog.php' Cross-Site Scripting Vulnerability

OptimalSite CMS is a content management system. A cross-site scripting vulnerability exists in OptimalSite CMS 'displaydialog.php', which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack...

Landesk Management Suite 'serverlist_grouptree.aspx' Cross-Site Scripting Vulnerability

Landesk Management Suite is a system management solution. A cross-site scripting vulnerability exists in Landesk Management Suite 'serverlistgrouptree.aspx', which can be exploited by a remote attacker to construct a malicious URI and trick a user into parsing it, which can be used to obtain a...

Multiple Cisco Products Cross-Site Scripting Vulnerabilities

Cisco AnyConnect Secure Mobility Client is a mobile client VPN tool.Cisco HostScan Engine is a host scanning engine. Cisco AnyConnect Secure Mobility Client and Cisco Host Scan fail to properly validate URLs used to construct applet paths in the DOM, allowing attackers to conduct cross-site...

Asus RT-N10 Plus Router 'flag' parameter cross-site scripting vulnerability

The Asus RT-N10 Plus Router is a router device. A cross-site scripting vulnerability exists in the handling of the 'flag' parameter in the Asus RT-N10 Plus Router, which can be exploited by a remote attacker to construct a malicious URI and trick the user into parsing it, which can be used to...

FancyFon FAMOC Session Fixation Vulnerability

FancyFon FAMOC is a mobile device management platform. FancyFon FAMOC suffers from a session fixation vulnerability that can be exploited by an attacker to hijack arbitrary sessions and gain unauthorized access in affected applications...

TechSmith Camtasia Open Redirect Vulnerability

TechSmith Camtasia a tool specialized in recording screen actions, it can easily record screen actions in any color mode, including images, sound effects, mouse tracks, narration sounds and more. An open redirection vulnerability exists in TechSmith Camtasia, which can be exploited by remote...

Mozilla Firefox/Thunderbird/SeaMonkey Proxy Authentication Session Fixation Vulnerability

Firefox/Thunderbird/SeaMonkey are web browsers and mail/newsgroup clients released by Mozilla. A session fixation vulnerability exists in Mozilla Firefox/Thunderbird/SeaMonkey, which can be exploited by an attacker to hijack arbitrary sessions and gain unauthorized access to affected applications...