GitBook Cross-Site Scripting Vulnerability

GitBook is a command-line tool for publishing and hosting books online. A cross-site scripting vulnerability exists in GitBook 2.6.9 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability...

AntiDisposmail - Detecting Disposable Email Addresses

Antbot.pw provides a free, open API endpoint for checking a domain or email address against a frequently-updated list of disposable domains. CORS is enabled for all originating domains, so you can call the API directly from your client-side code. GET https://antibot.pw/api/[email protected]...

Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack

// Axel '0vercl0k' Souchet - November 19 2019 // EDB Note: Download https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47752.zip // 0:000 ? xul!sAutomationPrefIsSet - xul // Evaluate expression: 85724947 = 00000000051c0f13 const XulsAutomationPrefIsSet = 0x051c0f13n;...

Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack

Mozilla FireFox Windows 10 x64 - Full Chain Client Side Attack // Axel '0vercl0k' Souchet - November 19 2019 // EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47752.zip // 0:000 ? xul!sAutomationPrefIsSet - xul // Evaluate expression: 8572494...

SCEditor Cross-Site Scripting Vulnerability

SCEditor is a WYSIWYG editor. A cross-site scripting vulnerability exists in SCEditor version 2.1.3, which stems from the lack of proper validation of client-side data in a WEB application and can be exploited by an attacker to execute client-side code...

@agreed/cli (0.0.6), @agreed/ui (0.0.6) +6 more potentially affected by CVE-2019-16769 via serialize-javascript (2.1.0)

serialize-javascript NPM version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @agreed/cli 0.0.6 - @agreed/ui 0.0.6 - @commercetools-frontend/mc-html-template =15.1.4-canary.7, =15.1.4-canary.7,...

OpenWrt Cross-Site Scripting Vulnerability (CNVD-2020-09617)

OpenWrt is a Linux operating system for embedded devices. A cross-site scripting vulnerability exists in OpenWrt version 18.06.4. The vulnerability stems from the lack of proper validation of client-side data by the WEB application, which can be exploited by an attacker to execute client-side cod...

Red Hat JBoss BRMS Cross-Site Scripting Vulnerability

Red Hat JBoss BRMS is a suite of platforms for the development of containerized microservices and applications to automate business decisions from Red Hat, USA. A cross-site scripting vulnerability exists in Red Hat JBoss BRMS versions prior to 5.1.0, which stems from a lack of proper validation ...

Cloudera Manager Cross-Site Scripting Vulnerability (CNVD-2020-14237)

Cloudera Manager is a suite of Hadoop data management software from Cloudera. The software supports creating clusters, authentication, data backup and recovery, and more. A cross-site scripting vulnerability exists in Cloudera Manager versions prior to 5.4.3. The vulnerability stems from the WEB...

WordPress NextGEN Gallery Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.NextGEN Gallery is an image gallery plugin used in it. A cross-site scripting vulnerability exists in WordPress NextGEN Gallery. The...

Cloudera Manager Cross-Site Scripting Vulnerability

Cloudera Manager is a suite of Hadoop data management software from Cloudera. The software supports creating clusters, authentication, data backup and recovery, and more. A cross-site scripting vulnerability exists in the Help Query feature in Cloudera Manager versions 5.7.x before 5.7.6, 5.8.x...

Security Bulletin: IBM InfoSphere Information Analyzer is affected by an AngularJS client-side template injection vulnerability

Summary An AngularJS client-side template injection vulnerability was addressed by IBM InfoSphere Information Analyzer. Vulnerability Details CVEID: CVE-2019-4660DESCRIPTION: It is possible to inject AngularJS template syntax in an internal page request within Information Analyzer, which is...

GHSA-FMQW-VQH5-CWQ9 Apache NiFi user log out issue

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out t...

Siemens Polarion webclient cross-site scripting vulnerability (CNVD-2019-44255)

Siemens Polarion is a suite of application lifecycle management software from Siemens, Germany. The software supports end-to-end enterprise application development in a unified, modular, browser-based software environment. webclient is one of the web-based client programs. A cross-site scripting...

Activity for Drupal Cross-Site Scripting Vulnerability

Drupal is an open source content management system developed by the Drupal community using the PHP language.Activity is one of the Activity modules. A cross-site scripting vulnerability exists in Activity for Drupal version 6.x-1.x. The vulnerability stems from the WEB application lacking proper...

Siemens Polarion webclient Cross-Site Scripting Vulnerability

Siemens Polarion is a suite of application lifecycle management software from Siemens, Germany. The software supports end-to-end enterprise application development in a unified, modular, browser-based software environment. webclient is one of the web-based client programs. A cross-site scripting...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-44257)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX. The vulnerability stems from the...

Siemens Polarion webclient cross-site scripting vulnerability (CNVD-2019-44254)

Siemens Polarion is a suite of application lifecycle management software from Siemens, Germany. The software supports end-to-end enterprise application development in a unified, modular, browser-based software environment. webclient is one of the web-based client programs. A cross-site scripting...

Cloudera Manager Cross-Site Scripting Vulnerability (CNVD-2019-46403)

Cloudera Manager is a suite of Hadoop data management software from Cloudera. The software supports creating clusters, authentication, data backup and recovery, and more. A cross-site scripting vulnerability exists in Cloudera Manager versions 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x befo...

Centreon Cross-Site Scripting Vulnerability (CNVD-2019-46409)

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . A cross-site scripting vulnerability exists in Centreon versions prior to 2.8.30, 18.x...