Cross-Site Scripting

Overview Affected versions of jquery are vulnerable to cross-site scripting. This occurs because the main jquery function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that jquery may interpret HTML as...

BEST Mumbai Bus Ticket & Pass - Customized SSL, Exported ContentProvider, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application BEST Mumbai Bus Ticket & Pass published at the 'play' market has multiple vulnerabilities...

Gratipay: Content-Length restriction bypass to heap overflow in gip.rocks.

I started playing around with a0xnirudh's Content-Length restriction bypass and noticed that when combined with a different vulnerability this could be leveraged to do a bit more than DoS. We decided to open a new ticket to address this issue, since we were already aware of the bypass. a0xnirudh...

CVE-2015-3883

Multiple cross-site scripting XSS vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the 1 searchkeywords parameter to index.php/users page; the 2 "Name of application" on index.php/configuration; 3 a new project name on index.php/projects; 4 the task na...

CVE-2017-5621

An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the content of a ticket article, when using either the REST API or the WebSocket API...

Responsive Events Movie Ticket Booking Script - SQL Injection

Responsive Events Movie Ticket Booking Script - SQL Injection Exploit Title: Responsive Events & Movie Ticket Booking Script - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software :...

How to Import NetScaler exported configuration: File-Introduction and Requirements?

With StoreFront 3.7, we introduced the ability to import an exported configuration from NetScaler Gateway. With the introduction of this feature, we enhance the capabilities previously available by allowing multiple vServers to be imported from a single configuration file. The Remote access...

DEBIAN-CVE-2016-9139

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...

CVE-2016-9139

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...

CVE-2016-9139

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...

UBUNTU-CVE-2016-9139

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...

CVE-2016-9139

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...

F5 TLS Session Ticket Implementation Remote Memory Disclosure (Ticketbleed) (uncredentialed check)

Based on its response to a resumed TLS connection, the remote service appears to be affected by an information disclosure vulnerability, known as Ticketbeed, in the TLS Session Ticket implementation. The issue is due to the server incorrectly echoing back 32 bytes of memory, even if the Session I...

Joomla JE Ticket System 1.2 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component JE Ticket System v1.2 - SQL Injection Google Dork: inurl:index.php?option=comjeticket Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy:...

Joomla JE Ticket System 1.2 SQL Injection

Exploit Title: Joomla! Component JE Ticket System v1.2 - SQL Injection Google Dork: inurl:index.php?option=comjeticket Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy: https://extensions.joomla.org/extensions/extension/clients-a-communities/help-desk/je-ticket-syste...

MS14-068-domain privilege escalation vulnerability summary-vulnerability warning-the black bar safety net

0x01 vulnerability of origin Said to ms14-068,have to say the silver ticket, that is, the cheque in. Cheque is a piece of tgs, that is, a service Ticket. The service ticket is the client is sent directly to the server and request the service resource. If the server is not the domain controller dc...

ticket.kutxabank.es XSS vulnerability

Vulnerable URL: https://ticket.kutxabank.es/janto/main.php?Nivel=Evento\"-confirmOPENBUGBOUNTY//=170219MUSIK Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

Joomla! Component JE Ticket System 1.2 - SQL Injection

Joomla! Component JE Ticket System 1.2 - SQL Injection Exploit Title: Joomla! Component JE Ticket System v1.2 - SQL Injection Google Dork: inurl:index.php?option=comjeticket Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy:...

Joomla! Component JE Ticket System 1.2 - SQL Injection

Exploit Title: Joomla! Component JE Ticket System v1.2 - SQL Injection Google Dork: inurl:index.php?option=comjeticket Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy: https://extensions.joomla.org/extensions/extension/clients-a-communities/help-desk/je-ticket-syste...

Finding Ticketbleed

Ticketbleed CVE-2016-9244 is a software vulnerability in the TLS stack of certain F5 products that allows a remote attacker to extract up to 31 bytes of uninitialized memory at a time, which can contain any kind of random sensitive information, like in Heartbleed. If you suspect you might be...