Alfresco 5.2.4 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Alfresco 5.2.4 - Persistent Cross-Site Scripting Exploit Author: Romain LOISEL & Alexandre ZANNI https://pwn.by/noraj - Pentesters from Orange Cyberdefense France Vendor Homepage: https://www.alfresco.com/ Software Link:...

Alfresco 5.2.4 - Persistent Cross-Site Scripting

Exploit Title: Alfresco 5.2.4 - Persistent Cross-Site Scripting Date: 2020-03-02 Exploit Author: Romain LOISEL & Alexandre ZANNI https://pwn.by/noraj - Pentesters from Orange Cyberdefense France Vendor Homepage: https://www.alfresco.com/ Software Link: https://www.alfresco.com/ecm-software Versio...

Alfresco 5.2.4 Cross Site Scripting

Exploit Title: Alfresco 5.2.4 - Persistent Cross-Site Scripting Date: 2020-03-02 Exploit Author: Romain LOISEL & Alexandre ZANNI https://pwn.by/noraj - Pentesters from Orange Cyberdefense France Vendor Homepage: https://www.alfresco.com/ Software Link: https://www.alfresco.com/ecm-software Versio...

Alfresco 5.2.4 - Persistent Cross-Site Scripting

Alfresco 5.2.4 - Persistent Cross-Site Scripting Exploit Title: Alfresco 5.2.4 - Persistent Cross-Site Scripting Date: 2020-03-02 Exploit Author: Romain LOISEL & Alexandre ZANNI https://pwn.by/noraj - Pentesters from Orange Cyberdefense France Vendor Homepage: https://www.alfresco.com/ Software...

CVE-2020-8777

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 rb65251d6-b368 has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document...

Design/Logic Flaw

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 rb65251d6-b368 has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document...

CVE-2020-8777

CVE-2020-8777 affects Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0. The issue is a stored XSS via a user profile photo, demonstrated by a SCRIPT element in an SVG document. Public references document XSS in the SVG photo handling and note affected versions; an Exploit-DB e...

CVE-2020-8777

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 rb65251d6-b368 has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document...

PT-2020-20269 · Alfresco · Alfresco Community +1

Name of the Vulnerable Software and Affected Versions: Alfresco Enterprise versions prior to 5.2.7 Alfresco Community versions prior to 6.2.0 rb65251d6-b368 Description: The issue allows for XSS via a user profile photo. This can be achieved by including a SCRIPT element in an SVG document...

Microsoft Windows User Profile Service Elevation of Privilege Vulnerability

Microsoft Windows is a family of operating systems from Microsoft. An elevation of privilege vulnerability exists when Microsoft Windows User Profile Service improperly handles symbolic links. An attacker could exploit the vulnerability to delete files and folders in an elevated context...

CVE-2020-0730

An elevation of privilege vulnerability exists when the Windows User Profile Service ProfSvc improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'...

CVE-2020-0730

An elevation of privilege vulnerability exists when the Windows User Profile Service ProfSvc improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'...

Privilege escalation

An elevation of privilege vulnerability exists when the Windows User Profile Service ProfSvc improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'...

CVE-2020-0730

CVE-2020-0730 concerns Windows User Profile Service (ProfSvc) elevation of privilege due to improper handling of symbolic links. The CNVD-2020-14305 entry describes that an attacker could delete files and folders in an elevated context by exploiting this symlink handling issue. The provided conne...

Windows User Profile Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows User Profile Service ProfSvc improperly handles symlinks. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker would first have to...

Privilege Escalation

github.com/goharbor/harbor is vulnerable to privilege escalation. The API call to update user profile is not validated, allowing an attacker to modify the email address of another user and subsequently perform a successful password reset to gain access to that user's account...

CVE-2018-12385

A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally...

Temporary User Profiles Received Instead of Citrix Profile Management Profiles

Citrix Profile Management has been installed and configured in the environment. A Citrix Profile Management Store has been setup for the users where their profiles should be stored. When a user logs in they are receiving a temporary windows user profile instead of a Citrix Profile Management...

WordPress CarSpot premium theme <= 2.2.2 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (registration form & user profile)

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress CarSpot premium theme versions = 2.2.2. Solution Update the WordPress CarSpot premium theme to the latest available version at least 2.2.3...

CarSpot < 2.2.3 - Multiple Vulnerabilities

Multiple vulnerabilities was discovered in the 'CarSpot – Dealership Wordpress Classified Theme', tested version — v2.2.0: - Authenticated Persistent XSS - Registration Form/User Profile - Authenticated Persistent XSS - Ad Post - IDOR leading to arbitrary deletion of ads Edit WPScanTeam: January...