2458 matches found
CVE-2019-18873
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload...
Design/Logic Flaw
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload...
CVE-2019-18873
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload...
CVE-2019-18873
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload...
CVE-2019-18873
FUDForum 3.0.9 is affected by CVE-2019-18873 (and related CVE in sources) via Stored XSS in the User-Agent header, enabling remote code execution. The issue arises in admsession.php and admuser.php, and requires an authenticated user to trigger the attack; when an admin visits the affected area u...
PT-2019-15708
Name of the Vulnerable Software and Affected Versions FUDForum version 3.0.9 Description The issue allows for Stored XSS via the User-Agent HTTP header, potentially resulting in remote code execution. An attacker can compromise the system by using a user account and sending a GET request. When an...
CVE-2019-18873: Improper Neutralization of Special Elements used in an OS Command
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload...
Detecting Account Takeover Botnets
A botnet is a network of compromised computers - known as bots - usually controlled by a command and control computer, that work together in coordination for a malicious purpose. In this blog post, we’ll discuss how to detect botnets used for account takeover ATO, an attack used to obtain the val...
NASA NODIS Cross Site Scripting
Cross-site Scripting XSS Vulnerability in NASA through User Agent - Binit Ghimire As of October 19, 2019, there exists a Reflected Cross-site Scripting XSS vulnerability in a sub-domain of the official NASA website as a result of the User Agent HTTP request header getting displayed in the webpage...
WordPress Popup Builder 3.49 Cross Site Scripting
Exploit Title: Wordpress Popup Builder 3.49 - Persistent Cross-Site Scripting Google Dork: inurl:"\wp-content\plugins\popupbuilder" Date: 2019-06-13 Exploit Author: Unk9vvN Vendor Homepage: https://popup-builder.com/ Software Link: https://wordpress.org/plugins/popup-builder/ Version: 3.49 Tested...
SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2019:2345-2)
This update for webkit2gtk3 fixes the following issues : Updated to version 2.24.4 bsc1148931. Security issues fixed : CVE-2019-8644, CVE-2019-8649, CVE-2019-8658, CVE-2019-8669, CVE-2019-8678, CVE-2019-8680, CVE-2019-8683, CVE-2019-8684, CVE-2019-8688, CVE-2019-8595, CVE-2019-8607, CVE-2019-8615...
SUSE-SU-2019:2345-2 Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues: Updated to version 2.24.4 bsc1148931. Security issues fixed: - CVE-2019-8644, CVE-2019-8649, CVE-2019-8658, CVE-2019-8669, CVE-2019-8678, CVE-2019-8680, CVE-2019-8683, CVE-2019-8684, CVE-2019-8688, CVE-2019-8595, CVE-2019-8607, CVE-2019-8615...
CVE-2019-17488
b3log Symphony aka Sym before 3.6.0 has XSS via the HTTP User-Agent header...
CVE-2019-17488
b3log Symphony aka Sym before 3.6.0 has XSS via the HTTP User-Agent header...
Design/Logic Flaw
b3log Symphony aka Sym before 3.6.0 has XSS via the HTTP User-Agent header...
CVE-2019-17488
CVE-2019-17488 affects b3log Symphony (Sym) before 3.6.0, where a cross-site scripting (XSS) vulnerability exists via the HTTP User-Agent header. The connected CNVD entry notes the root cause as lack of proper validation of client-side data by the web application, enabling potential client-side c...
CVE-2019-17488
b3log Symphony aka Sym before 3.6.0 has XSS via the HTTP User-Agent header...
CVE-2019-17488
b3log Symphony aka Sym before 3.6.0 has XSS via the HTTP User-Agent header...
PT-2019-15163
Name of the Vulnerable Software and Affected Versions b3log Symphony aka Sym versions prior to 3.6.0 Description The issue allows for XSS via the HTTP User-Agent header. Recommendations For versions prior to 3.6.0, update to version 3.6.0 or later to resolve the issue...