5626 matches found
Barracuda Cloud Control 7.1.1.003 - Cross Site Vulnerability
Document Title: =============== Barracuda Cloud Control 7.1.1.003 - Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1992 Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID:...
HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability
Document Title: =============== HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1452 Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID: ====================================...
Barracuda Cloud Control v3.020 - CS XSS Web Vulnerability
Document Title: =============== Barracuda Cloud Control v3.020 - CS XSS Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=662 Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID: ==================================== 6...
BMW - (Token) Cross Site Scripting Web Vulnerability
Document Title: =============== BMW - Token Cross Site Scripting Web Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1914 Video: https://www.youtube.com/watch?v=txjW7fpMJ-Q Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1737 Vulnerability...
Barracuda Cloud Control 7.1.1.003 - XSS Web Vulnerability
Document Title: =============== Barracuda Cloud Control 7.1.1.003 - XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1992 Release Date: ============= 2018-07-16 Vulnerability Laboratory ID VL-ID: ====================================...
HackerOne: Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com
Hi, I made a talk earlier this month about Client-Side Race Conditions for postMessage on AppSecEU: https://speakerdeck.com/fransrosen/owasp-appseceu-2018-attacking-modern-web-technologies In this talk I mention some fun ways to race postMessages from a malicious origin before the legit source...
Barracuda ADC 5.x Client-Side Script Insertion
Document Title: =============== Barracuda ADC 5.x - Client Side Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1425 Release Date: ============= 2018-07-10 Vulnerability Laboratory ID VL-ID:...
Barracuda ADC 5.x - CS Cross Site Scripting Vulnerability
Document Title: =============== Barracuda ADC 5.x - CS Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1425 Release Date: ============= 2018-07-10 Vulnerability Laboratory ID VL-ID: ====================================...
Information disclosure
An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to client-side when pages bookmarked in web portal use the Single Sign-On feature...
WordPress WP Live Chat Support Pro Remote Code Execution Vulnerability
WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on PHP and MySQL servers.WP Live Chat Support Pro is a web chat plugin used in it. A remote code execution vulnerability exists in WordPress WP Liv...
CVE-2018-12426
The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remoteupload request with a .php filename and the image/jpeg content type...
CVE-2018-12426
The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remoteupload request with a .php filename and the image/jpeg content type...
Design/Logic Flaw
An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...
CVE-2018-1000556
WordPress version 4.8 + contains a Cross Site Scripting XSS vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacke...
CVE-2018-1000556
WordPress version 4.8 + contains a Cross Site Scripting XSS vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacke...
Cross site scripting
WordPress version 4.8 + contains a Cross Site Scripting XSS vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacke...
CVE-2018-1000556
WordPress version 4.8 + contains a Cross Site Scripting XSS vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacke...
DIGISOL DG-BR4000NG Cross-Site Scripting Vulnerability
DIGISOL DG-BR4000NG is a wireless router product from DIGISOL SYSTEMS, Mumbai. A cross-site scripting vulnerability exists in DIGISOL DG-BR4000NG. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of SSID client-side authentication only...