kocaeliolay.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1026681 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting kocaeliolay.com website a...

CVE-2019-13935

The CVE-2019-13935 issue affects Siemens Polarion webclient prior to version 19.2. It is a reflected XSS vulnerability caused by improper input validation in the web application, allowing execution of client-side code. Impact is limited to the browser context; no server-side compromise documented...

New Relic: Disclosure of locally served nerdpacks due to nr-local.net CORS policy misconfiguration

Hey team, I've discovered that webserver which serves NR1 nerdpacks locally after nr1 nerdpack:serve is executed allows cross-origin requests from every subdomain of nr-ext.net. Since the nr-ext.net domain is used as a sandbox for user-supplied apps, an attacker can place there a malicious code...

CVE-2019-15956

A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific UR...

CVE-2019-15956

A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific UR...

Authorization

A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific UR...

CVE-2019-15956 Cisco Web Security Appliance Unauthorized Device Reset Vulnerability

A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific UR...

CVE-2019-15956

The CVE-2019-15956 entry concerns Cisco Web Security Appliance (WSA) AsyncOS Web Management Interface vulnerability. Connected sources confirm an authenticated, remote attacker can exploit improper authorization on a specific URL to perform an unauthorized device reset. The documented impacts inc...

CVE-2019-15956 Cisco Web Security Appliance Unauthorized Device Reset Vulnerability

A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific UR...

CVE-2019-15956: Improper Access Control

A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific UR...

WordPress wp-spell-check Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-spell-check is a spell-checking plugin used in it. A cross-site request forgery vulnerability exists in WordPress wp-spell-check...

telebras.com.br Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8547 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting telebras.com.br website and its users. Following coordinat...

astrovibe.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1023282 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting astrovibe.com website and...

cssfontstack.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1023154 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting cssfontstack.com website a...

UBUNTU-CVE-2019-13683

Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Cisco Web Security Appliance Management Interface < 11.8.0-332 Cross-Site Scripting Vulnerability XSS

According to its self-reported version, Cisco Web Security Appliance WSA is affected by a cross-site scripting XSS vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information TRUSTED...

CVE-2012-1001

Chyrp contains multiple XSS flaws identified as CVE-2012-1001. The vulnerabilities occur in Chyrp before 2.1.2 and before 2.5 Beta 2, enabling remote attackers to inject arbitrary scripts via the content parameter to includes/ajax.php or the body parameter to includes/error.php. The root cause is...

Blue Route blog system at***.php page has arbitrary file download vulnerability

Blue Route Blog System is built with PHP+MySQL. Blue Route blog system at.php page exists arbitrary file download vulnerability, an attacker can use the vulnerability to download arbitrary files...

org.apache.nifi:nifi-framework-cluster (>=1.3.0, <=1.9.2), org.apache.nifi:nifi-framework-nar (>=1.3.0, <=1.9.2) +5 more potentially affected by CVE-2019-12421 via org.apache.nifi:nifi-web-security (>=1.3.0, <=1.9.2)

org.apache.nifi:nifi-web-security MAVEN version =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.9.2 Source cves: CVE-2019-12421 Source advisory: MEND:CVE-2019-12421...

Eclipse Mojarra PartialViewContextImpl XSS

The vulnerability of the faces/context/PartialViewContextImpl.java component in the Eclipse Mojarra library, as a implementation of Mojarra JavaServer Faces and Eclipse EE4J specifications, is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerabili...