CVE-2017-2641

CVE-2017-2641 is a Moodle vulnerability affecting Moodle 2.x and 3.x where an attacker can exploit a flaw in legacy user preferences to perform SQL injection on the Moodle database. The exploitation path, described in multiple advisories, can lead to remote code execution on vulnerable Moodle ser...

CVE-2017-2641

In Moodle 2.x and 3.x, SQL injection can occur via user preferences...

CVE-2017-5473

Removed by vendor...

Radiant CMS 1.1.3 - Multiple Persistent Cross-Site Scripting Vulnerabilities

Radiant CMS 1.1.3 - Multiple Persistent Cross-Site Scripting Vulnerabilities Exploit Title: Radiant CMS 1.1.3 - Mutiple Persistant XSS Vulnerabilities Exploit Author: David Silveiro Exploit Author Github: github.com/davidsilveiro Exploit Author Twitter: twitter.com/davidsilveiro Vendor Homepage:...

Radiant CMS 1.1.3 - Multiple Persistent Cross-Site Scripting Vulnerabilities

Exploit Title: Radiant CMS 1.1.3 - Mutiple Persistant XSS Vulnerabilities Exploit Author: David Silveiro Exploit Author Github: github.com/davidsilveiro Exploit Author Twitter: twitter.com/davidsilveiro Vendor Homepage: http://radiantcms.org/ Software Link: http://radiantcms.org/download/ Date:...

Like it or not, Microsoft Plans to Push Windows 10 Upgrade more Aggressively

This is no surprise that Microsoft wants you to install Windows 10. But, Hey Microsoft, Not everyone wants to upgrade to Windows 10. Many people are happy with Windows 7 or Windows 8.1 OS and don’t want to switch to the newest Windows 10 operating system. Days after the launch of Windows 10,...

CVE-2015-7761

Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760...

PhpWiki 1.5.4 - Multiple Vulnerabilities

PhpWiki 1.5.4 - Multiple Vulnerabilities Title: phpwiki 1.5.4 - Cross Site Scripting / Local File Inclusion Date: 29.08.15 Vendor: sourceforge.net/projects/phpwiki/ Affected versions: = 1.5.4 current Tested on: Apache2.2 / PHP5 / Deb32 Author: Smash Contact: smash at devilteam.pl 1/ Cross Site...

PhpWiki 1.5.4 - Multiple Vulnerabilities

Title: phpwiki 1.5.4 - Cross Site Scripting / Local File Inclusion Date: 29.08.15 Vendor: sourceforge.net/projects/phpwiki/ Affected versions: = 1.5.4 current Tested on: Apache2.2 / PHP5 / Deb32 Author: Smash Contact: smash at devilteam.pl 1/ Cross Site Scripting Cross-site scripting vulnerabilit...

phpwiki 1.5.4 - Cross Site Scripting / Local File Inclusion Vulnerabilities

Exploit for php platform in category web applications Title: phpwiki 1.5.4 - Cross Site Scripting / Local File Inclusion Date: 29.08.15 Vendor: sourceforge.net/projects/phpwiki/ Affected versions: = 1.5.4 current Tested on: Apache2.2 / PHP5 / Deb32 Author: Smash Contact: smash at devilteam.pl 1/...

Phabricator: XSS with Time-of-Day Format

Go to your user preferences - Put the following into Time-of-Day Format with the quote: '' - Open a repository diffusion - XSS-Popup The repository file-overview is the only place where I could see the XSS so far. Because it's a user own preference, it is not easy to actually do something...

Achievo 1.4.3 - Multiple Web Vulnerabilities

No description provided by source. Title: ====== Achievo v1.4.3 - Multiple Web Vulnerabilities Date: ===== 2012-01-30 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=403 VL-ID: ===== 403 Introduction: ============= Achievo is a flexible web-based resource management too...

Moving From Do Not Track to Can Not Track

NEW YORK–The movement in the security and privacy communities to push the Do Not Track standard as an answer to the problem of pervasive online tracking by ad companies and other entities has resulted in the major browser vendors including DNT as an option for users, giving them a method for...

Design/Logic Flaw

Unspecified vulnerability in Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information user preferences and caches via unknown vectors, related to a "limited session re-use."...

Telecom Italia Cookie Handling vulnerability allows hackers to hijack email accounts

A cookie is a piece of data that is issued by a server in an HTTP response and stored for future use by the HTTP client. Quite simply, a cookie is a small text file that is stored by a browser on the user’s machine. Cookies are plain text; they contain no executable code. The client then...

roundcube -- arbitrary file disclosure vulnerability

RoundCube development team reports: After getting reports about a possible vulnerability of Roundcube which allows an attacker to modify its users preferences in a way that he/she can then read files from the server, we now published updated packages as well as patches that fix this security issu...

CVE-2013-1471

Multiple cross-site scripting XSS vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMail Identity-Based Encryption IBE appliances allow user-assisted remote attackers to inject arbitrary web script or HTML via 1 the Add field for the Black List under Antispam...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMail Identity-Based Encryption IBE appliances allow user-assisted remote attackers to inject arbitrary web script or HTML via 1 the Add field for the Black List under Antispam...

CVE-2013-1471

CVE-2013-1471 describes multiple XSS vulnerabilities in Fortinet FortiMail prior to 4.3.4 on FortiMail Identity-Based Encryption (IBE) appliances. The issues arise from insufficient input sanitization in the web UI, specifically in admin/FEAdmin.html (the Add field for the Black List under Antisp...

CVE-2013-1471

Multiple cross-site scripting XSS vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMail Identity-Based Encryption IBE appliances allow user-assisted remote attackers to inject arbitrary web script or HTML via 1 the Add field for the Black List under Antispam...