429 matches found
Nelio Ab Testing < 4.6.4 - CSRF
The Nelio AB Testing WordPress plugin was affected by a CSRF security vulnerability...
WordPress Plugin Nelio AB Testing Server-Side Request Forgery (SSRF)
Case Study: SSRF in Nelio AB Testing WordPress Plugin Nelio AB Testing is a WordPress plugin used for A/B Testing in WordPress pages. We can download the source-code of the Plugin from plugins.svn.wordpress.org/nelio-ab-testing/tags/4.5.8/. Server-side Request Forgery SSRF is a vulnerability wher...
ab-archive.net XSS vulnerability
Vulnerable URL: http://www.ab-archive.net/search.html?q=paypal id payment php cartid"';-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 692277 VIP website status:| No Check...
CVE-2016-8376
An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. This non-validated redirect/non-validated forward OPEN REDIRECT allows chaining with authenticated vulnerabilities...
Open redirect
An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. This non-validated redirect/non-validated forward OPEN REDIRECT allows chaining with authenticated vulnerabilities...
Design/Logic Flaw
An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. WDC does not limit authentication attempts that may allow a brute force attack method...
Cross site scripting
An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. The web server URL inputs are not sanitized correctly, which may allow cross-site scripting vulnerabilities...
CVE-2016-8347
An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. WDC does not limit authentication attempts that may allow a brute force attack method...
CVE-2016-8356
An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. The web server URL inputs are not sanitized correctly, which may allow cross-site scripting vulnerabilities...
CVE-2016-8356
An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. The web server URL inputs are not sanitized correctly, which may allow cross-site scripting vulnerabilities...
CVE-2016-8347
CVE-2016-8347 affects Kabona AB WebDatorCentral (WDC) prior to version 3.4.0. The root cause is improper handling of authentication attempts, allowing unrestricted brute-force attempts against the login API. Reports indicate remote exploitability with no user interaction required, and the impact ...
CVE-2016-8347
An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. WDC does not limit authentication attempts that may allow a brute force attack method...
CVE-2016-8376
An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. This non-validated redirect/non-validated forward OPEN REDIRECT allows chaining with authenticated vulnerabilities...
CVE-2016-8376
Summary of CVE-2016-8376 : A non-validated redirect/forward (OPEN REDIRECT) vulnerability in Kabona AB WebDatorCentral (WDC) prior to version 3.4.0. The issue allows an attacker to chain with authenticated vulnerabilities, potentially affecting users via crafted URLs that redirect to a malicious ...
CVE-2016-8356
CVE-2016-8356 (Kabona AB WebDatorCentral, WDC) affects WebDatorCentral prior to version 3.4.0. The vulnerability is caused by unsanitized web server URL inputs, enabling cross-site scripting (XSS). Exploitation could be performed remotely over the network; the impact includes High confidentiality...
Boozt Fashion AB: Application code is not obfuscated -- OWASP M9 (2016)
Description : Boost android app is not obfuscated which lead to view the source code of the app. Impact : Attackers can steal code and reuse it or sell it to create new application or create a malicious fake application based on the initial one. POC : Step 1 : First, I did the basic reverse...
Boozt Fashion AB: Email spoofing at booztlet.com
Hello : This There is an Email Spoofing Vulnerability. Steps to reproduce: 1 Go to http://emkei.cz/ 2 Fill "From Email" field to [email protected] or any other booztlet email. 3 Fill the victim's address your address to "TO" field and fill in other details as you wish. You will receive email fro...
Boozt Fashion AB: Bypass email validity in newsletter field
Hi, I think i've discovered a little vulnerability on your website i don't know if she is outside the bug bounty program. In the newsletter field, the incorrect email addresses for example with special characters it's not accpeted. But with a specific HTTP request it's possible to bypass this...
[SECURITY] Fedora 25 Update: tinymce-4.5.1-1.fc25
TinyMCE is a platform independent web based Javascript HTML WYSIWYG editor control released as by Moxiecode Systems AB. It has the ability to convert HTML TEXTAREA fields or other HTML elements to editor instances. TinyMCE is very easy to integrate into other CMS systems...