CVE-2015-5062

Affected software: SilverStripe CMS & Framework (version 3.1.13, with references noting a fix in 3.1.14). Vulnerability type & root cause: Open redirect via the unvalidated returnURL parameter on the dev/build URL, enabling redirects to arbitrary sites and potential phishing. Impact (as described...

CVE-2015-4726

PHP remote file inclusion vulnerability in ajax/myajaxphp.php in AudioShare 2.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the config'basedir' parameter...

CVE-2015-3232

Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter...

Content Construction Kit (CCK) - Less Critical - Open Redirect - SA-CONTRIB-2015-126

The Content Construction Kit CCK project is a set of modules that allows you to add custom fields to nodes using a web browser. CCK uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain...

CVE-2015-4135

Cross-site scripting XSS vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2015-4135

Cross-site scripting XSS vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2015-4134

Open redirect vulnerability in goto.php in phpwind 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter...

phpwind 8.7 Cross Site Scripting

phpwind v8.7 XSS Cross-site Scripting Web Security Vulnerabilities Exploit Title: phpwind v8.7 goto.php? &url Parameter XSS Security Vulnerabilities Product: phpwind Vendor: phpwind Vulnerable Versions: v8.7 Tested Version: v8.7 Advisory Publication: May 25, 2015 Latest Update: May 25, 2015...

CVE-2015-3358

Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...

Open redirect

Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...

CVE-2015-3358

Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...

CVE-2015-3358

The CVE concerns the Drupal Tadaa! module (pre-7.x-1.4) which contains multiple open redirect vulnerabilities in its destination parameter used by callbacks that enable/disable modules or change variables. Attackers could lure users to arbitrary sites and conduct phishing via crafted URLs, as des...

Shopify: [persistent cross-site scripting] customers can target admins

hello, Let's say a shop has a checkout button. when we click buy now , you will be redirected to https://madamcury.myshopify.com/cart/1188733065:1?channel=buybutton&referer=javascript:alertdocument.cookie; Keep an eye on referer parameter in URL referer=javascript:alertdocument.cookie; A customer...

Ericsson Drutt Mobile Service Delivery Platform Open Redirect Vulnerability

Ericsson Drutt Mobile Service Delivery Platform MSDP is a business support system from Ericsson, Sweden, that supports Service Delivery Platforms SDPs for on-site and off-portal services. An open redirection vulnerability exists in the 3PI Manager of the Ericsson Drutt MSDP, which stems from the...

drupal: multiple issues

CVE-2015-2559 access bypass Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. In Drupal 7, this vulnerability is mitigated by the fact that it can only be exploited on sites where...

EMC M&R (Watch4net) MIB Browser Path Traversal

------------------------------------------------------------------------ Path traversal vulnerability in EMC M&R Watch4net MIB Browser ------------------------------------------------------------------------ Han Sahin, November 2014...

Drupal 6.x < 6.35 / 7.x < 7.35 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 6.x prior to 6.35 or 7.x prior to 7.35. It is, therefore, potentially affected by the following vulnerabilities : - An access bypass vulnerability exists in which password reset URLs can be forged. This allows a remote attacker to gain...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001

Access bypass Password reset URLs - Drupal 6 and 7 Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. In Drupal 7, this vulnerability is mitigated by the fact that it can only be...

Open redirect

Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 1 pidvesa cookie to u5admin/pidvesa.php or 2 uri parameter to u5admin/meta2.php...