CVE-2017-3965

The CVE-2017-3965 entry concerns the McAfee Network Security Management (NSM) web interface. The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in NSM prior to 8.2.7.42.2 that enables remote attackers to perform unauthorized tasks by issuing specially crafted URLs. The affected compone...

Grav CMS 1.2.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications CVE-2018-5233 Grav CMS admin plugin Reflected Cross Site Scripting XSS vulnerability Description Grav CMS is a flat-file CMS using Markdown files for content management Official Website. It has been elected "Best Open Source CMS of 2016" by CM...

mail.hp.gov.cn Open Redirect vulnerability

Open Bug Bounty ID: OBB-576430 Description| Value ---|--- Affected Website:| mail.hp.gov.cn Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Directory Traversal

localhost-now is vulnerable to directory traversal attacks. These attacks are possible by requesting a url such as ../../confidential.txt to get sensitive information...

CVE-2018-7032

CVE-2018-7032 affects the myrepos package, specifically the webcheckout component used when cloning via git. The issue is that URLs passed to git clone are not sanitized, enabling a remote attacker or MitM to craft a URL that could lead to arbitrary code execution (e.g., via an ext::sh -c attack ...

priestory.inzercia.sk XSS vulnerability

Open Bug Bounty ID: OBB-551509 Description| Value ---|--- Affected Website:| priestory.inzercia.sk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

getsalt.com XSS vulnerability

Open Bug Bounty ID: OBB-531367 Description| Value ---|--- Affected Website:| getsalt.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Showmax: Query string parameter modifications returned in page

NOTE BEFOREHAND: I KNOW it's not located on the core showmax.com domain, but that doesn't effect the applications of this and it still has the same risk. Summary: At https://sso.showmax.com/auth/failure?message=, you can change the message parameter to any text and it will be returned on the page...

CVE-2017-15714

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "format=%27;alert%27xss%27" to the URL an alert window would execute...

udaf70.fr XSS vulnerability

Open Bug Bounty ID: OBB-459180 Description| Value ---|--- Affected Website:| udaf70.fr Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

censtatd.gov.hk XSS vulnerability

Open Bug Bounty ID: OBB-449151 Description| Value ---|--- Affected Website:| censtatd.gov.hk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

ds.iris.edu XSS vulnerability

Open Bug Bounty ID: OBB-447164 Description| Value ---|--- Affected Website:| ds.iris.edu Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

CVE-2017-16664

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...

CVE-2017-16664

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...

CVE-2017-16664

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...

CVE-2017-16664

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...

Code injection

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...

DEBIAN-CVE-2017-16664

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...

CVE-2017-16664

CVE-2017-16664 affects the Open Ticket Request System (OTRS). The flaw is a code injection in Kernel/System/Spelling.pm that allows an authenticated remote attacker to execute shell commands as the webserver user via URL manipulation. Affected versions are OTRS 5 before 5.0.24, 4 before 4.0.26, a...

CVE-2017-16664

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...