15186 matches found
Multiple XSS Vulnerabilities in PHPSHE B2C Mall System v1.5
PHPSHE online shopping mall system provides users with a low-cost, high-efficiency online shopping mall construction program. Multiple XSS vulnerabilities exist in PHPSHE B2C Mall System v1.5. An attacker can exploit this vulnerability to obtain information such as login cookies of administrative...
CVE-2017-6704
CVE-2017-6704 applies to the Cisco Prime Collaboration Provisioning Tool web application. An authenticated, remote attacker could exploit insufficient input validation to download arbitrary files from the system, reading files on the underlying filesystem. Public references in Cisco’s advisory co...
CVE-2017-6701
CVE-2017-6701 corresponds to a stored XSS vulnerability in the Cisco Identity Services Engine (ISE) web interface. The issue allows an unauthenticated, remote attacker to inject/script HTML in the web UI of an affected system. The root cause is insufficient sanitization of user-supplied data in t...
CVE-2017-6704
A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected...
HUMAX Gateway Backup File Download Vulnerability
Humax HG100R devices are prone to a backup file download vulnerability. This file contains sensitive information which may lead to further attacks. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...
niso.org XSS vulnerability
Vulnerable URL: http://www.niso.org/apps/grouppublic/projects.php?endinyear=1"...
WakaTime: Two email addresses can access the same account
Hello Team, When I was testing your web application I found that we can change the email address to a new email address. I tested that feature and noticed that after changing the email to a new email and then back to the old email, I can still access the account using both the email addresses...
skyhawkrugs.com XSS vulnerability
Vulnerable URL: http://skyhawkrugs.com/rugs.asp?collection=1"...
topnotchinc.com XSS vulnerability
Vulnerable URL: https://www.topnotchinc.com/docs/forms/employmentapp/application.asp?AttachedResume=No==1"...
WakaTime: Session not expired on logout
Description: Session management issue in https://wakatime.com Cookies are used to maintain session of the particular user and they should expire once the user logs out of his account.In secure web application,Cookies immediately expire once the user logs out of his account. But this is not...
SQL Injection Vulnerability in MallBuilder
MallBuilder is a multi-user online shopping mall solution based on PHP+MYSQL. MallBuilder suffers from a SQL injection vulnerability. An attacker can use this vulnerability to steal database information and control the operating system...
CVE-2017-6026
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization an...
CVE-2017-6038
A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request...
CVE-2017-6028
An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials...
Cross site request forgery (csrf)
A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request...
CVE-2017-6038
A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request...
CVE-2017-6026
Affected products: Schneider Electric Modicon PLCs (M241 and M251) with firmware versions prior to 4.0.5.11. Root cause / vulnerability: Use of insufficiently random values in session numbers generated by the web application, leading to potential session compromise due to shared session identifie...
The likelihood of collaborative oa \app\team\block\control.php SQL injection
No description provided by source...