CVE-2012-0334

Cisco IronPort Web Security Appliance AsyncOS before 7.5 contains a SSL certificate caching flaw in its insecure SSL/TLS handling, enabling unauthenticated, remote attackers on adjacent networks to perform MITM by injecting forged certificates. The vulnerability stems from improper validation of ...

OSIsoft PI Vision Cross-Site Scripting Vulnerability

OSIsoft PI Vision is a set of commercialized software application platform based on Ckient/Server structure from OSIsoft, supporting data acquisition, analysis and visualization. A cross-site scripting vulnerability exists in OSIsoft PI Vision, which can be exploited by an attacker to cause the...

Google to Nix Chrome Support for Third-Party Cookies by 2022

Google has set an aggressive two-year deadline for dropping support for third-party tracking cookies in its Chrome web browser. Tracking cookies, which allow advertisers to virtually follow people around the web, are used for ad targeting. The move follows a number of privacy hardening steps by...

jenkins: Stored XSS vulnerability in expandable textbox form control

In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents typically Job/Configure...

Oracle Java SE/Java SE Embedded CVE-2020-2593 Remote Security Vulnerability

Description Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. The vulnerability can be exploited over multiple protocols. This issue affects the 'Networking' component. This vulnerability affects the following supported versions: Java SE: 7u241, 8u231, 11.0.5,...

Oracle Java SE/Java SE Embedded CVE-2020-2583 Remote Security Vulnerability

Description Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. The vulnerability can be exploited over multiple protocols. This issue affects the 'Serialization' component. This vulnerability affects the following supported versions: Java SE: 7u241, 8u231, 11.0.5,...

Adobe Experience Manager APSB20-01 Multiple Cross Site Scripting Vulnerabilities

Description Adobe Experience Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affecte...

Webshell Bypass Vulnerability in Web Security Dog (Apache Edition) (CNVD-2020-12884)

Website Security Dog Apache Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection features. Web Security Dog Apache Edition has a webshell bypass vulnerability. Attackers can use the vulnerability to bypass Web...

Oracle Java SE/Java SE Embedded CVE-2020-2659 Remote Security Vulnerability

Description Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. The vulnerability can be exploited over multiple protocols. This issue affects the 'Networking' component. This vulnerability affects the following supported versions: Java SE: 7u241, 8u231; Java SE...

nasu.com.ua Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8594 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting nasu.com.ua website and its users. Following coordinated a...

CVE-2019-18894

Affected software: Avast Premium Security 19.8.2393. Issue: a flaw in the local web server running by Avast Antivirus on port 27275 that processes a command enables arbitrary OS command execution with the privileges of the currently logged-in user. Impact: could allow an attacker (e.g., via a com...

mcdomain.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1066176 Security Researcher foulenzer Helped patch 132 vulnerabilities Received 3 Coordinated Disclosure badges Received 1 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting mcdomain.de website and it...

CVE-2019-17016

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR 68.4 and Firefox 72...

Tishna - Complete Automated Pentest Framework For Servers, Application Layer To Web Security

Complete Automated pentest framework for Servers, Application Layer to Web Security Interface Software have 62 Options with full automation and can be use for web security swiss knife Tishna Tishna is Web Server Security Penetration Software for Ultimate Security Analaysis Kali, Parrot OS, Black...

CVE-2019-9537

CVE-2019-9537 concerns Telos Automated Message Handling System (AMHS). The vulnerability is an improper neutralization of input in uploaditem.asp, enabling a remote attacker to inject arbitrary script into an AMHS session (cross-site scripting). Affected versions are AMHS before 4.1.5.5. Several ...

CVE-2013-1642

QuiXplorer (before 2.5.5) is affected by multiple XSS vulnerabilities. The issue enables remote attackers to inject arbitrary web script or HTML via parameters (dir, item, order, searchitem, selitems[], srt) to index.php or via QUERY_STRING. Impact includes possible client-side script execution; ...

CVE-2013-7062

CVE-2013-7062 concerns multiple cross-site scripting (XSS) vulnerabilities in Zope used by Plone 3.3.x–3.3.6, 4.0.x–4.0.9, 4.1.x–4.1.6, 4.2.x–4.2.7, and 4.3–4.3.2. The issue arises from input that is not properly filtered in two components: (1) browser_id_manager and (2) OFS.Image, enabling remot...

historisches-festmahl.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1057250 Security Researcher error404 Helped patch 534 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting historisches-festmahl.de...

CVE-2019-19734

accountmovefileinfolder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection...

Heatmiser Netmonitor 3.03 - Hardcoded Credentials

Heatmiser Netmonitor 3.03 - Hardcoded Credentials Exploit Title: Heatmiser Netmonitor 3.03 - Hardcoded Credentials Date: 2019-12-22 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.heatmiser.com/en/ Hardware Link: https://www.zoneregeling.nl/heatmiser/netmonitor-handleiding.pdf...