CVE-2014-2866

CommonSpot (PaperThin) before 7.0.2 and 8.x before 8.0.3 is vulnerable because access restrictions rely on client-side JavaScript, which can be bypassed by an attacker who can modify that code to perform operations that should be restricted. The Red Hat security entry documents the same descripti...

http-dombased-xss NSE Script

It looks for places where attacker-controlled information in the DOM may be used to affect JavaScript execution in certain ways. The attack is explained here: See also: http-stored-xss.nse http-phpself-xss.nse http-xssed.nse http-unsafe-output-escaping.nse Script Arguments...

Code injection

IBM Rational Build Forge 7.1.2 relies on client-side JavaScript code to enforce the EditSecurity permission requirement for the Export Key File function, which allows remote authenticated users to read a key file by removing a disable attribute in the Security sub-menu...

Fixed HTTP Session Cookies

The remote web application uses cookies to track authenticated users. If the session cookie is already present before authentication, it remains unchanged after a successful login. A remote attacker can exploit this to hijack a valid user session. Session cookies are expected to be unpredictable ...

Code injection

The web interface on the Axesstel MV 410R relies on client-side JavaScript code to validate input, which allows remote attackers to send crafted data, and possibly have unspecified other impact, via a client that does not process JavaScript...

CVE-2009-2320

The CVE-2009-2320 issue affects the Axesstel MV 410R web interface where input validation relies on client-side JavaScript; remote attackers could send crafted data via a client that does not process JavaScript. The root cause is reliance on client-side validation, enabling potential unspecified ...

CVE-2008-4515

Blue Coat K9 Web Protection 4.0.230 Beta relies on client-side JavaScript as a protection mechanism, which allows remote attackers to bypass authentication and access the 1 summary, 2 detail, 3 overrides, and 4 pwemail pages by disabling JavaScript...

Working Resources BadBlue 1.7.3 - cleanSearchString() Cross-Site Scripting

Working Resources BadBlue 1.7.3 - cleanSearchString Cross-Site Scripting source: https://www.securityfocus.com/bid/5179/info BadBlue is a P2P file sharing application distributed by Working Resources. It is designed for use on Microsoft Windows operating systems. BadBlue is operated through a web...

Working Resources BadBlue 1.7.3 - 'cleanSearchString()' Cross-Site Scripting

source: https://www.securityfocus.com/bid/5179/info BadBlue is a P2P file sharing application distributed by Working Resources. It is designed for use on Microsoft Windows operating systems. BadBlue is operated through a web interface, generated by an included web server running on the local...