Lufthansa AG - (Limbo) Open Redirect Web Vulnerability

Document Title: =============== Lufthansa AG - Limbo Open Redirect Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2060 LHPROD-66558 COM-1036050 Release Date: ============= 2017-05-23 Vulnerability Laboratory ID VL-ID:...

Zomato: CSRF To Like/Unlike Photos

Description: There is a CSRF vulnerability allowing an attacker to trick a user into visiting his/her site and to forge a request to zomato.com that will in turn like or unlike the photos of the attacker's choosing. The vulnerable page is https://www.zomato.com/php/photoViewerActionsHandler.php ,...

Lufthansa AG - (Limbo) Open Redirect Web Vulnerability

Document Title: =============== Lufthansa AG - Limbo Open Redirect Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2060 LHPROD-66558 COM-1036050 Release Date: ============= 2017-05-22 Vulnerability Laboratory ID VL-ID:...

IBM Rational Team Concert HTML Injection Vulnerability (CNVD-2017-10396 )

IBM Rational Team Concert RTC is the U.S. IBM's set of Jazz-based platform and support for decentralized teams for real-time collaboration related to software lifecycle management solutions. An HTML injection vulnerability exists in IBM RTC. A remote attacker could exploit this vulnerability by...

Design/Logic Flaw

An issue was discovered on Accellion FTA devices before FTA912180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site...

Super File Explorer 1.0.1 Arbitrary File Upload

Document Title: =============== Super File Explorer 1.0.1 - Arbitrary File Upload Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2034 Release Date: ============= 2017-02-23 Vulnerability Laboratory ID VL-ID:...

Stanford University (MBC) - SQL Injection Web Vulnerability

Document Title: =============== Stanford University MBC - SQL Injection Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2004 ID: INC000003888376 Release Date: ============= 2017-05-03 Vulnerability Laboratory ID VL-ID:...

CVE-2017-8104

In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter...

MantisBT 'Timeline include' page cross-site scripting vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the Timeline include page used in the My View myviewpage.php and User...

Coppermine Gallery Directory Traversal Vulnerability

Coppermine Photo Gallery is a web-based album management system. A directory traversal vulnerability exists in the Coppermine Photo Gallery page "piceditor.php", which can be exploited by an attacker to traverse directory files and obtain sensitive information...

UBUNTU-CVE-2017-5647

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. Thi...

Certec EDV GmbH atvise scada cross-site scripting vulnerability

Certec EDV GmbH is based in Austria. atvise is a web-based HMI monitoring and data acquisition system. A cross-site scripting vulnerability exists in Certec EDV GmbH atvise scada. An attacker may be able to exploit this vulnerability to execute arbitrary script code in the browser of an...

Doctors Appointment Script SQL Injection Vulnerability

Doctors Appointment Script is an apartment booking service website built with HTML5, CSS3, PHP 5 and jQuery. Doctors Appointment Script has a SQL injection vulnerability in several parameters such as lat, lon, category, etc. on the search page, which can be exploited by an attacker to read...

The vulnerability of the Cisco Unified Communications Manager system allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Cisco Unified Communications Manager IP telephony management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to bypass the Cross-Site Scripting XSS filter and perform cross-site...

Stored Cross-Site Scripting Vulnerability in Beijing Topsy's Government Affairs System

Beijing Topsy's government system is an intensive service platform based on cloud PAAS, with all kinds of portal government services, public services as the core, relying on mature big data, cloud computing, mobile Internet, content management, full-text search and other technologies, in accordan...

NetIQ Access Manager Cross-Site Scripting Vulnerability (CNVD-2017-04960)

NetIQ Access Manager NAM is a resource access control solution from NetIQ, USA. The solution provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users. A cross-site scripting vulnerability exists in NetIQ Access Manager NAM. A remote attacker can...

CVE-2017-7247

Multiple Cross-Site Scripting XSS were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data torrents, size passed to the 'Gazelle-master/sections/tools/managers/multiplefreeleech.php' URL. An attacker could execute arbitrary HTML...

Web and mobile Unified communication platforms(Active UC)remote command execution vulnerability

No description provided by source...

CVE-2017-7202

Multiple Cross-Site Scripting XSS were discovered in SLiMS 7 Cendana before 2017-03-16. The vulnerabilities exist due to insufficient filtration of user-supplied data id passed to the 'slims7cendana-master/template/default/detailtemplate.php' and...

Cisco Prime Service Catalog Cross-Site Scripting Vulnerability (CNVD-2017-03681)

Cisco Prime Service Catalog PSC is a service catalog solution from Cisco that provides all IT services through a single web portal. The solution supports automated ordering of computing, networking, storage, and other data center resources in a unified service catalog. web framework is one of the...