Glassdoor: Open Redirect ████████

The URL with the 'redirectUrl' parameter was found to be vulnerable to an open redirect attack. The parameter was not properly validated, allowing an attacker to redirect users to a malicious website of their choice...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-article.php by adding a question mark ? followed by the payload...

CVE-2020-10448

CVE-2020-10448 corresponds to a reflected XSS vulnerability in Chadha PHPKB Standard Multi-Language 9. The issue arises from how URIs are handled in admin/header.php, enabling injection of arbitrary script/HTML via a URI payload on various admin pages (e.g., admin/report-referrers.php, admin/add-...

CVE-2020-10442

CVE-2020-10442 concerns Chadha PHPKB Standard Multi-Language 9. The issue arises from how URIs are processed in admin/header.php, enabling Reflected XSS in multiple admin pages (e.g., admin/report-article-popular.php; per Red Hat advisories, related entries show affected paths such as admin/add-a...

CVE-2020-10419

CVE-2020-10419 affects Chadha PHPKB Standard Multi-Language 9: URIs mishandled in admin/header.php enable Reflected XSS on admin/manage-categories.php by appending a ? payload. Red Hat entries (RH:CVE-2020-10419, RH:CVE-2020-10391, RH:CVE-2020-10456) describe similar Reflected XSS behavior target...

Phishing Attack Skirts Detection With YouTube

Researchers are warning of an increase in phishing emails that use YouTube redirect links, which help attackers skirt traditional defense measures. If certain malicious URLs are blocked by web browser phishing filters, attackers commonly use a redirector URL to bypass these filters and redirect t...

A week in security (March 2 – 8)

Last week on Malwarebytes Labs, we fired up part 1 of our series on child identity theft, asked how well law enforcement can deal with cybercriminals, and took a trip down the memory lane of moral panic. We also looked at the positives and negatives of VPNs and examined our own progress in the...

Exploit for Path Traversal in Pivotal_Software Spring_Framework

Web-Security-Learning 项目地址： https://github.com/CHYbeta/Web-Security-Learning 最近更新日期为：2018/10/31。 同步更新于： chybeta: Web-Security-Learning 目录： - Web-Security-Learning - Web Security - sql注入 - MySql - MSSQL - PostgreSQL - MongoDB - 技巧 - 工具 - XSS - CSRF - 其他前端安全 - SSRF - XXE - JSONP注入 - SSTI - 代码执行 /...

Exploit for Improper Input Validation in Jenkins

hackUtils It is a hack tool kit for pentest and web security research, which is based on BeautifulSoup bs4 module http://www.crummy.com/software/BeautifulSoup/bs4/. Usage: hackUtils.py options Options: -h, --help Show basic help message and exit -b keyword, --baidu=keyword Fetch URLs from Baidu...

CVE-2019-19772

Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=ENUS...

CVE-2020-9530

The CVE describes an issue in Xiaomi MIUI V11.0.5.0.QFAEUXM where the GetApps export component (com.xiaomi.mipicks) mishandles opening other components. An attacker could lure a user to load malicious web pages via WebView in Messaging (com.android.MMS) in a specific network environment, leading ...

lakemacquariefn.com.au Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1111407 Security Researcher geeknik Helped patch 8722 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting lakemacquariefn.com.au...

bearpile.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1110545 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting bearpile.com website and...

CVE-2020-3164

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance ESA, Cisco Web Security Appliance WSA, and Cisco Content Security Management Appliance SMA could allow an unauthenticated remote attacker to cause high CPU usage on an affected device,...

CVE-2020-3164

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance ESA, Cisco Web Security Appliance WSA, and Cisco Content Security Management Appliance SMA could allow an unauthenticated remote attacker to cause high CPU usage on an affected device,...

CVE-2020-3164

Summary: CVE-2020-3164 is a GUI Denial of Service vulnerability in Cisco AsyncOS web interfaces for the Cisco Email Security Appliance (ESA), Web Security Appliance (WSA), and Content Security Management Appliance (SMA). It stems from improper validation of specific HTTP request headers, allowing...

nrdcactionfund.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1109573 Security Researcher Zodx Helped patch 35 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting nrdcactionfund.org website and its users. Following...

CVE-2018-14384

CVE-2018-14384 affects the Website Manager module of SEO Panel ≤3.13.0, with a stored XSS vulnerability exploitable by remote authenticated attackers via the websites.php name parameter. The issue allows injection of arbitrary script/HTML and is documented with CVSS v2 base score 3.5 (LOW) and CV...

CVE-2019-20486

The CVE-2019-20486 entry affects NETGEAR WNR1000V4 devices (firmware 1.1.0.54). The web management console pages setup.cgi and adv_index.htm are vulnerable to stored XSS, demonstrated via configuring the UI language. The root cause is a stored cross-site scripting flaw in the UI language configur...

Web Security Dog (Apache Edition) V4.0 suffers from SQL Injection Bypass Vulnerability

Website Security Dog is a server tool that integrates website content security protection, website resource protection and website traffic protection functions. Functions covered by the net horse / Trojan scanning, anti-SQL injection, anti-stolen links, anti-CC attacks, real-time website traffic...