2625 matches found
Profiles Are Not Written Back to User Store on Logoff
Under certain circumstances User Profiles are not written back to the UPM User Store during log off...
DNN (DotNetNuke) < 8.0.1 XSS Vulnerability
DNN formerly DotNetNuke is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Shopify: Deleted Post and Administrative Function Access in eCommerce Forum
Hi, I initially queried the following report as a comment in 165048, in which @juanbroullon confirmed the issue appeared valid and requested I open a new Shopify report. A selection of privileged information is provided upon appending /edit to a user profile URL on the eCommerce forum as an...
CVE-2016-6211
Removed by vendor...
CVE-2016-6211: Undefined Security Weakness
The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form...
Yelp: IDOR(indirect object references) on add friend,complement and send message
Hi security , Description: I found user id in encrypted form from there profile url https://www.yelp.com/userdetails?userid= on intercepting request of add friend, complement and send message i can identify user id .. when i change identified user ID to other user's ID then request of add friend ...
DotNetNuke cross-site scripting vulnerability (CNVD-2016-07083)
DotNetNuke DNN is a set of U.S. DNN company supported by Microsoft , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. A cross-site scripting vulnerability exists in the user-profile profile area in DNN...
Legal Robot: Validation bypass on user profile
A security researcher discovered that form validations for fields like first name, last name, and job title could be bypassed while editing a user profile...
CVE-2016-7119: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...
PT-2016-7228
Name of the Vulnerable Software and Affected Versions DotNetNuke DNN versions prior to 8.0.1 Description The issue is related to a cross-site scripting XSS vulnerability in the user-profile biography section. This allows remote authenticated users to inject arbitrary web script or HTML via a...
GitLab - impersonate Feature Privilege Escalation
GitLab - impersonate Feature Privilege Escalation Exploit Title: GitLab privilege escalation via "impersonate" feature Date: 02-05-2016 Software Link: https://about.gitlab.com/ Version: 8.2.0 - 8.2.4, 8.3.0 - 8.3.8, 8.4.0 - 8.4.9, 8.5.0 - 8.5.11, 8.6.0 - 8.6.7, 8.7.0 Exploit Author: Kaimi Website...
CVE-2016-1609
Multiple cross-site scripting XSS vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input, as demonstrated by a crafted attribute of an IMG element in the phone field of ...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input, as demonstrated by a crafted attribute of an IMG element in the phone field of ...
PT-2016-4887
Name of the Vulnerable Software and Affected Versions Novell Filr versions prior to 1.2 Security Update 3 Novell Filr versions prior to 2.0 Security Update 2 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via crafted input. This can be demonstrated ...
CVE-2016-1609: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input, as demonstrated by a crafted attribute of an IMG element in the phone field of ...
PT-2016-6800
Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.44 Description The issue allows remote authenticated users to gain privileges through certain vectors involving contributed or custom code that triggers a rebuild of the user profile form. Recommendations For version...
Zomato: Unvalidated redirect on user profile website
The user profile redirect request is not properly validated. The presence of parameter t which is being passed through the request is verified but same value can be reused to any unauthenticated or authenticated user to redirect them to any web site. Sample link is given below...
Liferay CE < 6.2 CE GA6 - Persistent Cross-Site Scripting
CVE-2016-3670 Stored Cross Site Scripting in Liferay CE 1. Vulnerability Properties Title: Stored Cross-Site Scripting Liferay CE CVE ID: CVE-2016-3670 CVSSv3 Base Score: 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Vendor: Liferay Inc Products: Liferay Advisory Release Date: 27 May 2016 Advisory URL:...
AjaxExplorer 1.10.3.2 - Multiple Vulnerabilities
Exploit for php platform in category web applications + Credits: hyp3rlinx + ISR: apparitionsec Vendor: ========== sourceforge.net smsid download linx: sourceforge.net/projects/ajax-explorer/files/ Product: ======================= AjaxExplorer v1.10.3.2 Manage server files through simple windows...