853 matches found
Information disclosure
IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history...
CVE-2016-8982
IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history...
CVE-2016-8982
IBM InfoSphere DataStage (part of IBM InfoSphere Information Server) is affected by CVE-2016-8982. The vulnerability involves storing sensitive information in URL parameters, which could be disclosed if URLs are exposed in server logs, the Referrer header, or browser history. Affected products/ve...
CVE-2016-3045
IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history...
CVE-2016-3045
IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history...
Information disclosure
IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history...
CVE-2016-3045
IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history...
uswitch.com XSS vulnerability
Vulnerable URL: https://www.uswitch.com/broadband/go/MTYxMzYtMTI0NjQ5NTItMTIxNzUtMC0wLTEwMw==?postcode=1984858449=291156=table=Sky=Sky=...
The vulnerability of the Simatic PCS 7 software allows a remote attacker to compromise the confidentiality of protected information.
The vulnerability exists in Web Navigator of Siemens WinCC due to the different behaviors of NetBIOS user names, depending on whether a user account exists or not. Exploiting this vulnerability allows remote users who have been authenticated to list user accounts using specially crafted URL...
Umbraco CMS Security Bypass Vulnerability
Umbraco CMS is a Danish Umbraco company using ASP.Net build , Mysql for data storage content management system CMS. The system supports customized templates , manage users , rights definition of content and so on. A security bypass vulnerability exists in Umbraco CMS. The vulnerability allows...
Cisco ASA VPN Portal Cross-Site Scripting
A cross-site scripting vulnerability has been reported in Cisco ASA VPN portal. The vulnerability is due to lack of data sanitization on URL parameters. A remote attacker can exploit this vulnerability by sending a specially crafted request to an affected server...
Shopify: [livechat.shopify.com] Cookie bomb at customer chats
When we visit the https://livechat.shopify.com/customer/chats/new page the ref and ssid URL parameters are used to set cookie values the way as follows: var getURLParameter = functionname return decodeURIComponentnew RegExp'?|&' + name + '=' + '^&;+?&||;|$'.execlocation.search||,""1.replace/+/g,...
Udemy: Reflected XSS and/or malicious redirection via JWPlayer 6 configuration modification
1 Malicious attacker by visiting course page e.g. https://www.udemy.com/overview-of-big-data-hadoop/ and intercepting browser's generated requests can find one to the following URL:...
Kentico CMS Open Redirect Vulnerability
Kentico CMS is an enterprise-grade web content management system and customer experience management system. An open redirection vulnerability exists in Kentico CMS 8.2 through 8.2.41. This allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by redirecting...
Cisco WebEx Meeting Center GET Parameter Vulnerability
A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to view sensitive information that is transmitted in GET parameters or perform SQL injection. The vulnerability is due to the inclusion of sensitive information in the URL as GET parameters. An attacker...
CVE-2015-4656
Multiple cross-site scripting XSS vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the 1 success parameter to login.php or 2 crafted URL parameters to index.php, as demonstrated by the t parameter to photo/...
BMC Footprints Service Core 11.5 Cross Site Scripting
About the Product: BMC FootPrints Service Core is an IT service and asset management platform used by many organizations to help the IT departments deliver more value to businesses. Advisory Details: During a Penetration testing, Help AG auditor Ayman Abdelaziz discovered the following: 1 Stored...
[RT-SA-2014-015] Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0
Advisory: Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0 RedTeam Pentesting discovered a cross-site scripting XSS vulnerability in the Tapatalk plugin for the WoltLab Burning Board forum software, which allows attackers to inject arbitrary JavaScript code via URL parameters...
WoltLab Burning Board 4.0 Tapatalk Cross Site Scripting
Advisory: Cross-site Scripting in Tapatalk Plugin for WoltLab Burning Board 4.0 RedTeam Pentesting discovered a cross-site scripting XSS vulnerability in the Tapatalk plugin for the WoltLab Burning Board forum software, which allows attackers to inject arbitrary JavaScript code via URL parameters...
ResourceSpace Multiple Cross Site Scripting, and HTML and SQL Injection Vulnerabilities
Title: ResourceSpace Multiple Cross Site Scripting, and HTML and SQL Injection Vulnerabilities Author: Petri Iivonen Contact: petri.iivonenattmbcgovuk Discovered: 11 June 2014 Updated: 11 December 2014 Published: 11 December 2014 Vendor: Montala Limited Vendor url: www.resourcespace.org Software:...