CVE-2015-4135

Cross-site scripting XSS vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2015-4134: Undefined Security Weakness

Open redirect vulnerability in goto.php in phpwind 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter...

PT-2015-6425

Name of the Vulnerable Software and Affected Versions phpwind version 8.7 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter in the goto.php file. Recommendations For phpwind version 8.7, consider...

CVE-2015-4135: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

PT-2015-6426

Name of the Vulnerable Software and Affected Versions phpwind version 8.7 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the url parameter in the goto.php file. Recommendations For...

phpwind 8.7 Cross Site Scripting

phpwind v8.7 XSS Cross-site Scripting Web Security Vulnerabilities Exploit Title: phpwind v8.7 goto.php? &url Parameter XSS Security Vulnerabilities Product: phpwind Vendor: phpwind Vulnerable Versions: v8.7 Tested Version: v8.7 Advisory Publication: May 25, 2015 Latest Update: May 25, 2015...

CVE-2015-3358

Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...

Open redirect

Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...

CVE-2015-3358

The CVE concerns the Drupal Tadaa! module (pre-7.x-1.4) which contains multiple open redirect vulnerabilities in its destination parameter used by callbacks that enable/disable modules or change variables. Attackers could lure users to arbitrary sites and conduct phishing via crafted URLs, as des...

CVE-2015-3358

Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...

Shopify: [persistent cross-site scripting] customers can target admins

hello, Let's say a shop has a checkout button. when we click buy now , you will be redirected to https://madamcury.myshopify.com/cart/1188733065:1?channel=buybutton&referer=javascript:alertdocument.cookie; Keep an eye on referer parameter in URL referer=javascript:alertdocument.cookie; A customer...

Ericsson Drutt Mobile Service Delivery Platform Open Redirect Vulnerability

Ericsson Drutt Mobile Service Delivery Platform MSDP is a business support system from Ericsson, Sweden, that supports Service Delivery Platforms SDPs for on-site and off-portal services. An open redirection vulnerability exists in the 3PI Manager of the Ericsson Drutt MSDP, which stems from the...

PT-2015-5639

Name of the Vulnerable Software and Affected Versions Ericsson Drutt Mobile Service Delivery Platform MSDP versions 4 through 6 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the url parameter to...

drupal: multiple issues

CVE-2015-2559 access bypass Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. In Drupal 7, this vulnerability is mitigated by the fact that it can only be exploited on sites where...

EMC M&R (Watch4net) MIB Browser Path Traversal

------------------------------------------------------------------------ Path traversal vulnerability in EMC M&R Watch4net MIB Browser ------------------------------------------------------------------------ Han Sahin, November 2014...

Drupal 6.x < 6.35 / 7.x < 7.35 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 6.x prior to 6.35 or 7.x prior to 7.35. It is, therefore, potentially affected by the following vulnerabilities : - An access bypass vulnerability exists in which password reset URLs can be forged. This allows a remote attacker to gain...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001

Access bypass Password reset URLs - Drupal 6 and 7 Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. In Drupal 7, this vulnerability is mitigated by the fact that it can only be...

Open redirect

Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 1 pidvesa cookie to u5admin/pidvesa.php or 2 uri parameter to u5admin/meta2.php...

xdg-utils Eval Injection Vulnerability

xdg-utils is a set of command line tools used to help applications integrate with various desktop tasks. An Eval injection vulnerability exists in xdg-utils version 1.1.0 RC1. An attacker can exploit this vulnerability to execute arbitrary code with the help of the 'URL' parameter...

MediaWiki Listings Extension Cross-Site Scripting Vulnerability

MediaWiki is a Wiki program. The MediaWiki Listings page fails to adequately filter the 'name' or 'url' parameter, which can be exploited by remote attackers to inject arbitrary web script or HTML...