FoxyCart Bug Bounty #1 - Filter Bypass & Persistent Vulnerability

Document Title: =============== FoxyCart Bug Bounty 1 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1451 098bdc9b309783df65044c5abb690dafdd4bcd436c380ae68c924fe37e14b4e0 Release Date: ============= 2015-07-15...

Airdroid iOS, Android & Win 3.1.3 - Persistent Vulnerability

Document Title: =============== Airdroid iOS, Android & Win 3.1.3 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1543 Release Date: ============= 2015-07-20 Vulnerability Laboratory ID VL-ID: ==================================...

Splunk Enterprise and Splunk Light Input Validation Cross-Site Scripting Vulnerability

Splunk is the engine of machine data. Splunk collects, indexes, and utilizes fast-moving computer data generated by all applications, servers, and devices. Splunk suffers from a cross-site scripting vulnerability that could be exploited by a remote attacker to inject malicious script or HTML code...

Multiple cross-site scripting vulnerabilities in Cisco WebEx Meeting Center (CNVD-2015-04700)

Cisco WebEx Meeting Center is a web-based online meeting product within a suite of WebEx meeting solutions. A cross-site scripting vulnerability in Cisco WebEx Meeting Center allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain...

CVE-2015-1936

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

CVE-2015-1936

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

FoxyCart Bug Bounty #1 - Bypass & Persistent Vulnerability

Document Title: =============== FoxyCart Bug Bounty 1 - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1451 098bdc9b309783df65044c5abb690dafdd4bcd436c380ae68c924fe37e14b4e0 Release Date: ============= 2015-07-14...

phpSQLiteCMS - Multiple Vulnerabilities

phpSQLiteCMS suffers from cross site request forgery, cross site scripting, arbitrary file upload, and privilege escalation vulnerabilities. + Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPSQLITECMS0712.txt Vendor:...

IBM WebSphere Application Server Session Hijacking Vulnerability

IBM WebSphere Application Server is an application server product that serves as a platform for Java EE and Web services applications and is the foundation of the IBM WebSphere software platform. A session hijacking vulnerability exists in IBM WebSphere Application Server, which allows remote...

CVE-2015-0544

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value...

Design/Logic Flaw

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value...

CVE-2015-0544

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value...

Ebay Magento Application-Side Cross Site Scripting

Document Title: =============== Ebay Magento Bug Bounty 14 - Persistent Description Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1463 EIBBP-31602 Release Date: ============= 2015-06-30 Vulnerability Laboratory ID VL-ID:...

IBM Security Network Protection Cross-Site Scripting Vulnerability

IBM Security Network Protection is a next-generation network intrusion prevention system. The system monitors application usage, website access and operation execution within the network to avoid attacks from malware, botnets and other threats. IBM Security Network Protection suffers from a...

Pinterest Fixes Validation Vulnerability in API

Pinterest recently fixed an issue in the API of its web app that could have allowed remote attackers to compromise emails and carry out session hijacking and phishing attacks. Vulnerability Lab researcher Benjamin Kunz Mejri discovered the issue, which is a persistent mail encoding and validation...

Pinterest Bug Bounty #1 - Persistent CNAME Vulnerability

Document Title: =============== Pinterest Bug Bounty 1 - Persistent CNAME Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1431 Release Date: ============= 2015-06-30 Vulnerability Laboratory ID VL-ID: ==================================== 14...

Pinterest Bug Bounty #1 - Persistent CNAME Vulnerability

Document Title: =============== Pinterest Bug Bounty 1 - Persistent CNAME Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1431 Release Date: ============= 2015-06-29 Vulnerability Laboratory ID VL-ID: ==================================== 14...

Netty and Play Framework Session Hijacking Vulnerability

Netty is a java open source framework provided by JBOSS . A session hijacking vulnerability exists in Netty and Play Framework, which can be exploited by an attacker to gain unauthorized access to an affected application...

ZOHO ManageEngine AssetExplorer Cross-Site Scripting Vulnerability

ZOHO ManageEngine AssetExplorer is a suite of asset management software. The software provides asset tracking, scanning of IT assets and tracking of asset ownership. ZOHO ManageEngine AssetExplorer handles a cross-site scripting vulnerability in Publisher registry entries, which allows remote...

Drupal OpenID Module Session Hijacking Vulnerability

Drupal is an open source content management framework CMF written in the PHP language, which consists of a content management system CMS and PHP development framework Framework together. A session hijacking vulnerability exists in the OpenID module in Drupal versions 6.x before 6.36 and 7.x befor...