CVE-2017-16819

A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows remote attackers to inject arbitrary JavaScript in the nameFirst aka First Name field for the employee details page /employee.html that is then reflected in multiple pages where...

CVE-2017-16819

The CVE-2017-16819 vulnerability affects Icon Time Systems RTC-1000 firmware v2.5.7458 and earlier. It is a stored cross-site scripting flaw in the nameFirst (First Name) field on the employee.html page, which is reflected on multiple pages where that field is used. The underlying impact is sessi...

Icon Time Systems RTC-1000 Firmware 2.5.7458 - Cross-Site Scripting

Exploit Title: Icon Time Systems RTC-1000 alert"xss"; ========================================================== PROOF OF CONCEPT - With valid credentials that has permissions to modify the employee records, access the employeelist.html page via Lists-Employees - Click on an active employee...

CVE-2017-16568

Persistent Cross-Site Scripting XSS vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScript payloads, which become permanently stored on the server and execute when a user plays the compromised radio...

PT-2017-14451 · Logitech · Logitech Media Server

Name of the Vulnerable Software and Affected Versions: Logitech Media Server version 7.9.0 Description: The issue is related to a Cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via a favorite. This vulnerability can lead to Session...

CVE-2017-1000152

CVE-2017-1000152 affects Mahara 15.04 prior to 15.04.7 and 15.10 prior to 15.10.3 when running PHP 5.3. The issue allows one user to be logged in as another on a separate computer because the same session ID is served. Root cause: duplicate/session response handling leads to cross-user session ex...

IBM Infosphere BigInsights Link Injection Vulnerability

IBM InfoSphere BigInsights is a suite of software platforms for storing and analyzing "Big Data" from IBM in the United States. The platform provides solutions for managing and analyzing massive amounts of structured and unstructured data. A link injection vulnerability exists in IBM Infosphere...

CVE-2017-1552

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning...

CVE-2017-1552

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning...

Cross site scripting

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning...

CVE-2017-1552

CVE-2017-1552 affects IBM InfoSphere BigInsights 4.2.0 and 4.2.5. The IBM bulletin confirms a link-injection vulnerability in the web UI that could be exploited by a user clicking a specially crafted URL to induce cross-site scripting, cache poisoning, or session hijacking. Affected products/vers...

CVE-2017-1552

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning...

Session fixation vulnerability in Rails

Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."...

LetoDMS Cross-Site Request Forgery Vulnerability

LetoDMS is a document management system based on PHP+MySQL development. A cross-site request forgery vulnerability exists in LetoDMS versions prior to 3.3.8, which can be exploited by remote attackers to hijack a victim's authentication...

CVE-2017-14332

Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to hijack sessions by determining SessionID values...

CVE-2017-14332

Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to hijack sessions by determining SessionID values...

CVE-2017-14332

Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to hijack sessions by determining SessionID values...

CVE-2017-14332

CVE-2017-14332 affects Extreme EXOS 15.7, 16.x, 21.x, and 22.x. The vulnerability enables remote attackers to hijack sessions by determining SessionID values. The connected sources confirm this is a session hijacking issue in Extreme EXOS; no exploits, vectors, or patch details are provided in th...

Extreme EXOS Session Hijacking Vulnerability

Extreme EXOS is a new generation modular switch operating system from Extreme Networks. A session hijacking vulnerability exists in Extreme EXOS. A remote attacker can exploit this vulnerability by determining the SessionID value to hijack a session...

Afian AB FileRun 2017.03.18 - Multiple Vulnerabilities

Afian AB FileRun 2017.03.18 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact:...