Trend Micro Control Manager task_controller Information Disclosure

An information disclosure vulnerability has been reported in Trend Micro Control Manager. The vulnerability is due to lack of validation of the 'url' parameter in the request for taskcontrol.php. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted HT...

SQL Injection Vulnerability in the groupUrl Parameter of getGroupedProjectTemplate on the Internet User Speed Measurement Platform of Freescale Technology (Beijing) Co.

FeiShiDa Technology Beijing Co., Ltd. Internet user speed test platform is used to provide users with mobile broadband online test WEB system. The product has a SQL injection vulnerability, the vulnerability URL is: http://target/getGroupedProjectTemplate?groupUrl=, the injection parameter is:...

SQL Injection Vulnerability in Fuzhou Tranda Special Equipment Safety Monitoring System

Fuzhou Chuangda special equipment safety monitoring system using B / S structure, the use of J2EE for development, the system can run on any operating system platform, running into the server and client operation, the server runs the corresponding WEB APPLICATION services such as: TOMCAT, JBOSS,...

Khan Academy: OPEN URL REDIRECT through PNG files

An abuse of the imageurl parameter when saving a CS program was able to create an arbitrary external redirect. We now validate the parameter before using it. I have found a way through which an attacker can use png files to redirect to malicious domain...

rentcar.alkhouzama.ma XSS vulnerability

Vulnerable URL: http://rentcar.alkhouzama.ma/index.php?lang=zh-CN"...

Trend Micro Control Manager task_controller Information Disclosure Vulnerability

This vulnerability allows remote attackers to leak sensitive information on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within taskcontroller.php. The url parameter does not properly sanitize the...

Cross-Site Scripting

Overview Affected versions of swagger-ui are vulnerable to cross-site scripting via the url query string parameter. Recommendation Update to 2.2.1 or later. References - GitHub Issue - GitHub Advisory...

Cross-Site Scripting

Overview Affected versions of swagger-ui contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document. Proof of Concept The vulnerable object structure is: "definitions": "arbitraryVal": "properties": "": "LoremIpsum" Malicious JSON documents can ...

Bumble: Change contents of the careers iframe in https://corp.badoo.com/jobs

Hi again badoo team , In https://corp.badoo.com/jobs/?p= if you check the page you'll see an iframe from https://jobs.jobvite.com/badoo/ , the p parameter is used to control the iframe link for example if you added https://corp.badoo.com/jobs/?p=somepath the iframe link will be...

edmc.edu XSS vulnerability

Vulnerable URL: http://www.edmc.edu/?SuccessListClientState=...

WebSummit: Time Based SQL injection in url parameter

There is possibility of inducing some time delay in the "url" parameter of the videos.websummit.com using the Benchmark and SQL queries, which could result in timeout for application upon huge delay induced into the application...

CVE-2015-7360

Multiple cross-site scripting XSS vulnerabilities in the Web User Interface WebUI in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 serial parameter to alerts/summary/profile/; the 2 urlForCreatingReport parameter to csearch/report/export/...

Open-Xchange: Cross-Site Scripting Vulnerability in dovecot.fi

Issue detail The name of an arbitrarily supplied URL parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e400a"alert15bd8b was submitted in the name of an arbitrarily supplied URL parameter. This input was echoed as...

Drupal 6.x < 6.35 / 7.x < 7.35 Multiple Vulnerabilities

Binary data 9213.prm...

trotting-new.ru Open Redirect vulnerability

Vulnerable URL: http://trotting-new.ru/.go.php?url=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 2 VI...

CVE-2016-0949

Adobe Connect before 9.5.2 allows remote attackers to have an unspecified impact via a crafted parameter in a URL...

vip4.exlive.cn XSS vulnerability

Vulnerable URL: http://vip4.exlive.cn:89/gpsapp/jsp/2.jsp?serverip=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

weightwatchers.com.au Open Redirect vulnerability

Open Bug Bounty ID: OBB-119571 Description| Value ---|--- Affected Website:| weightwatchers.com.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

prisguide.no XSS vulnerability

Vulnerable URL: http://www.prisguide.no/goto.php?shopid=149=http://www.elkjop.no/product/HUM210WIFI/huawei-mediapad-m2-10-nettbrett-16-gb-wifi-solv"alert'XSSPOSED'...

Ovidentia maillist Module 4.0 - Remote File Inclusion

Ovidentia maillist Module 4.0 - Remote File Inclusion Not for kiddies! Download: http://www.ovidentia.org/index.php?tg=fileman&sAction=getFile&id=17&gr=Y&path=Downloads%2FAdd-ons%2FModules%2Fmaillist&file=maillist-4-0.zip&idf=794 PoC: maillist-4-0/programs/mlincl.php line 4...