CVE-2015-4678

SQL injection vulnerability in Persian Car CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter to the default URI...

Sql injection

SQL injection vulnerability in Persian Car CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter to the default URI...

Drupal Node Template Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP.Node Template is a module that uses the structure and data of nodes as a template. A cross-site request forgery vulnerability exists in the Drupal Node Template module that allows a remote attacker to construct a maliciou...

EMC RSA Authentication Manager 8.x < 8.1 Patch 6 Unspecified URI Redirection

The remote host is running a version of EMC RSA Authentication Manager 8 prior to 8.1 Patch 6. It is, therefore, affected by an unspecified URI redirection vulnerability. An attacker can exploit this vulnerability to redirect users to arbitrary websites. C Tenable Network Security, Inc...

EUVD-2015-4172

The dosoapcall function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a...

Mail.ru: [mrgs.mail.ru] Internet Explorer XSS via Request-URI

Открыть с помощью Internet Explorer для формирования правильного запроса используется баг перенаправления, поэтому необходим сценарий "bf.am/x?r=" http://bf.am/x?r=https://mrgs.mail.ru/"/%252e%252e/%252e%252e/ Результат: /%2e%2e/%2e%2e/"...

Yelp: [engineeringblog.yelp.com] CRLF Injection

CRLF Injection via Request-URI PoC: https://engineeringblog.yelp.com/xxcrlftest%0d%0aSet-Cookie:%20test=test;domain=.yelp.com HTTP Response: HTTP/1.1 301 Moved Permanently ... Location: http://engineeringblog.yelp.com/xxcrlftest Set-Cookie: test=test;domain=.yelp.com Result: Creating a cookie-par...

Shopify: [www.*.myshopify.com] CRLF Injection

CRLF Injection via Request-URI PoC: http://www.myshopify.com/xxcrlftest%0aSet-Cookie:test=test3;domain=.myshopify.com; https://www.blackfan.myshopify.com/xxx%0aSet-Cookie:test=test2;domain=.myshopify.com; HTTP Response: HTTP/1.1 302 Moved Temporarily ... Location: http://myshopify.com/xxcrlftest...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to 1 org/apache/sling/api/servlets/HtmlResponse and 2...

CVE-2015-2944

Multiple cross-site scripting XSS vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to 1 org/apache/sling/api/servlets/HtmlResponse and 2...

CVE-2015-2944

Multiple cross-site scripting XSS vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to 1 org/apache/sling/api/servlets/HtmlResponse and 2...

CVE-2015-2944: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to 1 org/apache/sling/api/servlets/HtmlResponse and 2...

PT-2015-5993

Name of the Vulnerable Software and Affected Versions Apache Sling API versions prior to 2.2.2 Apache Sling Servlets Post versions prior to 2.1.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via the URI. This is related to the...

Cisco Unified Customer Voice Portal Cross-Site Request Forgery Vulnerability

Cisco Unified Customer Voice Portal CVP provides voice and video self-service. A cross-site request forgery vulnerability exists in Cisco Unified Customer Voice Portal, where the program fails to properly validate user input, allowing a remote attacker to construct a malicious URI, trick the user...

WordPress Wordfence Plugin <= 5.2.4 - Stored XSS

This plugin is prone to IPTraf.php URI request stored cross site scripting vulnerability. Solution Update plugin...

Cisco Headend Digital Broadband Delivery System Cross-Site Scripting Vulnerability

The Cisco Headend Digital Broadband Delivery System is a front-end broadband digital delivery system. A cross-site scripting vulnerability exists in the Cisco Headend Digital Broadband Delivery System. Because the program's WEB management interface fails to correctly filter user-submitted input, ...

Updated springframework packages fix CVE-2014-0225

Updated springframework packages fix security vulnerabilities: When processing user provided XML documents, the Spring Framework did not disable by default the resolution of URI references in a DTD declaration. By observing differences in response times, an attacker could then identify valid IP...

MGASA-2015-0211 Updated springframework packages fix CVE-2014-0225

Updated springframework packages fix security vulnerabilities: When processing user provided XML documents, the Spring Framework did not disable by default the resolution of URI references in a DTD declaration. By observing differences in response times, an attacker could then identify valid IP...

open-uri-cached Gem for Ruby Temporary File Creation Elevation of Privilege Vulnerability

open-uri-cached Gem for Ruby is a Ruby-based application. open-uri-cached Gem for Ruby insecurely creates temporary files when using YAML, allowing local attackers to exploit vulnerabilities for elevated privileges...

CVE-2015-3012

Multiple cross-site scripting XSS vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers to inject arbitrary web script or HTML via a 1 style or 2 font name or 3 javascript or 4 data URI...