Accentis Cross-Site Scripting Vulnerability

Accentis is a suite of management software for ERP, CRM, payroll, production and inventory management. Accentis fails to properly filter the 'ctl00$cphcontent$uigformState' parameter, allowing remote attackers to exploit the vulnerability by injecting malicious script or HTML code, obtaining...

WiFi Drive CR v1.0 iOS - Persistent Filename Dir List Vulnerability

Document Title: =============== WiFi Drive CR v1.0 iOS - Persistent Filename Dir List Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1595 Release Date: ============= 2015-09-23 Vulnerability Laboratory ID VL-ID:...

UDID v1.0 iOS - Persistent Mail Encode Vulnerability

Document Title: =============== UDID v1.0 iOS - Persistent Mail Encode Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1590 Release Date: ============= 2015-09-22 Vulnerability Laboratory ID VL-ID: ==================================== 1590...

Joomla Content History SQLi Remote Code Execution

This module exploits a SQL injection vulnerability found in Joomla versions 3.2 up to 3.4.4. The vulnerability exists in the Content History administrator component in the core of Joomla. Triggering the SQL injection makes it possible to retrieve active Super User sessions. The cookie can be used...

SAP NetWeaver AS Java NavigationURLTester - XSS vulnerability

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4 Vendor URL: SAP Bugs: XSS vulnerability Reported: 20.10.2015 Vendor response: 21.10.2015 Date of Public Advisory: 08.03.2016 Reference: SAP Security Note 2238375 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XSS...

EMC SourceOne Email Supervisor Session Hijacking Vulnerability

EMC SourceOne Email Supervisor is an email and IM content monitoring and management solution. A session hijacking vulnerability exists in the implementation of EMC SourceOne Email Supervisor Reviewer. An attacker could exploit this vulnerability to guess the session ID of another user...

SAP NetWeaver 7.4 (ProxyServer servlet) - XSS vulnerability

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4 Vendor URL: SAP Bugs: Cross Site Scripting XSS Reported: 10.08.2015 Vendor response: 11.08.2015 Date of Public Advisory: 09.02.2016 Reference: SAP Security Note 2220571 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class...

Open-Xchange (OX) App Suite XHTML File HTML Injection Vulnerability

Open-Xchange OX App Suite is prone to a cross-site scripting XSS vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program...

Open-Xchange (OX) App Suite Drive File XSS Vulnerability (Apr 2014)

Open-Xchange OX App Suite is prone to a cross-site scripting XSS vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program...

CVE-2015-2025

IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 do not set the secure flag on the session cookie in HTTPS, allowing interception of cookies in HTTP sessions. Affected versions: WebSphere eXtreme Scale 7.1.0 and 7.1.1. Remediation: apply fixes 7.1.0.3 (PI44105) or 7.1.1.1...

Open-Xchange Server and Open-Xchange AppSuite Front End Cross-Site Scripting Vulnerabilities

Open-Xchange Server is a semi-open source project mainly used for developing collaboration software; OX AppSuite is a set of Web cloud desktop environment. A cross-site scripting vulnerability exists in the dialogs for printing content in the Front End of Open-Xchange Server and OX AppSuite, whic...

ZeusCart 4 index.php search 跨站脚本漏洞

ZeusCart是一个电子商务购物车应用。ZeusCart处理search变量存在跨站脚本漏洞，远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。影响系统：ZeusCart 4发布时间:2015-03-10CVE ID:CVE-2015-2182CNCVE ID：CNCVE-20152182 ----------------------------------本地搭建环境测试POC截图：ZeusCart 4.1测试环境...

Flowdock API Script Insertion

Document Title: =============== Flowdock API Bug Bounty 3 - Invite Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1574 Release Date: ============= 2015-09-24 Vulnerability Laboratory ID VL-ID:...

Mango Automation 2.6.0 Unprotected Debug Log View

Mango Automation 2.6.0 Unprotected Debug Log View Vulnerability Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application tha...

BlinkSale Bug Bounty #2 - Cross Site Scripting Vulnerability

Document Title: =============== BlinkSale Bug Bounty 2 - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1448 Release Date: ============= 2015-09-28 Vulnerability Laboratory ID VL-ID: ===================================...

JSoup Cross-Site Scripting Vulnerability

JSoup is a Java HTML parser , it can be through the DOM, CSS, and JQuery-like operations to take out and manipulate data . Jsoup suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used t...

Flowdock API Bug Bounty #3 - Persistent Web Vulnerability

Document Title: =============== Flowdock API Bug Bounty 3 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1574 Vulnerability Magazine:...

Flowdock API Script Insertion

Document Title: =============== Flowdock API Bug Bounty 1 - Description Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1560 Release Date: ============= 2015-09-22 Vulnerability Laboratory ID VL-ID:...

WiFi Drive + CR v1.0 iOS - Persistent Filename Vulnerability

Document Title: =============== WiFi Drive + CR v1.0 iOS - Persistent Filename Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1595 Release Date: ============= 2015-09-23 Vulnerability Laboratory ID VL-ID: ==================================...

Flowdock API Bug Bounty #3 - Persistent Web Vulnerability

Document Title: =============== Flowdock API Bug Bounty 3 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1574 Vulnerability Magazine:...