93 matches found
CVE-2020-29072
LiquidFiles versions prior to 3.3.19 have a Cross-Site Script Inclusion vulnerability in client-side code. Exploitation requires user interaction (opening a link) and could lead to leakage of encrypted e-mail content via messages/sent?format=js and popup?format=js. Affected product: LiquidFiles p...
httpd: mod_rewrite potential open redirect
A vulnerability was discovered in Apache httpd, in modrewrite. Certain self-referential modrewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers...
Code injection
Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system...
httpd: mod_rewrite potential open redirect
A vulnerability was discovered in Apache httpd, in modrewrite. Certain self-referential modrewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers...
Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack Exploit
// Axel '0vercl0k' Souchet - November 19 2019 // EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47752.zip // 0:000 ? xul!sAutomationPrefIsSet - xul // Evaluate expression: 85724947 = 00000000051c0f13 const XulsAutomationPrefIsSet = 0x051c0f13...
Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack
Mozilla FireFox Windows 10 x64 - Full Chain Client Side Attack // Axel '0vercl0k' Souchet - November 19 2019 // EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47752.zip // 0:000 ? xul!sAutomationPrefIsSet - xul // Evaluate expression: 8572494...
Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe vulnerabilities could allow an attacker to execute arbitrary co...
CVE-2019-10098
A vulnerability was discovered in Apache httpd, in modrewrite. Certain self-referential modrewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers...
@amitport/useful (>=0.5.0, <=0.5.2), @bb-cli/bb-test-plugin-ngmock (1.5.8) +688 more potentially affected by unknown CVE via angular (>=1.0.8, <=1.5.11)
angular NPM version =1.0.8, =0.5.0, =0.2.7, =1.0.21, =0.2.1, =1.10.5, =0.2.0, =0.2.0-dev, =1.2.6, =0.3.2, =1.0.0, =1.0.0, =3.0.2, =4.5.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-28HP-FGCR-2R4H...
Security Bulletin: Security vulnerability in Oracle Java 7 impacts IBM Rational Change (CVE-2013-0422)
Summary Potential security vulnerability issues may occur if you are using the Oracle Java 7 updates reported in Oracle Security Alert for CVE-2013-0422 when using IBM Rational Change product. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts...
Security Bulletin: Security vulnerability in Oracle Java 7 impacts IBM Rational Collaborative Lifecycle Management products (CVE-2013-0422)
Summary Potential security vulnerability issues may occur if you are using the Oracle Java 7 updates reported in Oracle Security Alert for CVE-2013-0422 when using IBM Collaborative Lifecycle Management CLM products Rational Quality Manager, Rational Team Concert and Rational Requirements Compose...
Geldkarte - transaktionsid Cross Site Scripting Vulnerability
Document Title: =============== Geldkarte - transaktionsid Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2118 Release Date: ============= 2018-02-20 Vulnerability Laboratory ID VL-ID:...
Evolution Script CMS 5.3 Cross Site Scripting
Document Title: =============== Evolution Script CMS v5.3 - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2075 Release Date: ============= 2017-06-07 Vulnerability Laboratory ID VL-ID:...
Webgrind 'file' Parameter Cross-Site Scripting Vulnerability
Webgrind is a set of PHP execution time analysis tool . A cross-site scripting vulnerability exists in Webgrind's handling of the 'file' parameter, which can be exploited by a remote attacker to construct a malicious URI and trick the user into parsing it, which can be used to obtain a sensitive...
Cross-site scripting vulnerability in tcllib'::html::textarea' function
tcllib is a collection of packages for the Tcl programming language, distributed as both source code and precompiled binaries, and supporting a wide range of common operating systems: Windows, BSD, Unix, and Linux. A cross-site scripting vulnerability exists in the tcllib '::html::textarea'...
live800在线沟通平台客户端存储型XSS可攻击客服
简要描述： 帮朋友测试项目时无意间发现的。 详细说明： 我没有做过大量统计和测试，但根据我这几个月零零散散的测试我认为仍然存有大量的桌面应用，web应用和浏览器插件存有一摸一样的问题。 所以，这个XSS的输入点还是文件名。 漏洞证明： 首先我们构造这样的文件名： .jpg 随后通过http://x55.me/800.htm向客服发送文件，如下图： 现在切换到客服的应用界面，看发生了什么？...
Delphi and C++ Builder VCL library Buffer Overflow
1. Advisory Information Title: Delphi and C++ Builder VCL library Buffer Overflow Advisory ID: CORE-2014-0004 Advisory URL:http://www.coresecurity.com/core-labs/advisories/delphi-and-c-builder-vcl-library-buffer-overflow Date published: 2014-08-20 Date of last update: 2014-08-20 Vendors contacted...
用友人力资源管理软件SQL注入漏洞（无需登录，影响所有版本）
简要描述： 详细说明： 用友软件： 涉及客户非常多。都是大型国企、银行、能源、金融重要单位。 举例如下： 大连银行 http://zpyc.bankofdl.com 顺德农商行 http://career.sdebank.com 中国海洋石油总公司 http://zhaopin.cnooc.com.cn 北京市建筑设计研究院 www.biad.com.cn:88/ 民生银行 http://ehr.creditcard.cmbc.com.cn 中国中铁 http://61.232.6.108/ ....等等单位 直接谷歌搜 inurl:hrss/login.jsp inurl:hrss/r...
OTRS FAQ Module - Persistent XSS
No description provided by source. Exploit Title: OTRS Faq Module - Persistent XSS Date: 2-Apr-2013 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.otrs.com Version: OTRS ITSM 3.2.x,OTRS ITSM 3.1.x,OTRS ITSM 3.0.x Tested on: Perl CVE : CVE-2013-2637 OVERVIEW The OTRS ITSM FAQ Module 3.2...