CVE-2017-12161

It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further...

SAP NetWeaver UpdateThemeVersionPortalComponent XSS

The vulnerability of the UpdateThemeVersionPortalComponent component in the SAP NetWeaver software integration platform exists due to insufficient cleaning of data entered by users when they are displayed on the journal viewing page. Exploiting this vulnerability allows a malicious actor to execu...

SAP NetWeaver DownloadServlet XSS

The vulnerability of the DownloadServlet component in the SAP NetWeaver software integration platform exists due to insufficient data cleaning during the copying of requests into responses. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code on the client...

Geldkarte - transaktionsid Cross Site Scripting Vulnerability

Document Title: =============== Geldkarte - transaktionsid Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2118 Release Date: ============= 2018-02-20 Vulnerability Laboratory ID VL-ID:...

Coho 3960HD IP camera Code Execution

The vulnerability of the Microprogrammed IP Camera Cohu 3960HD is related to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure by manipulating camera parameters remotely...

How artificial intelligence stopped an Emotet outbreak

At 12:46 a.m. local time on February 3, a Windows 7 Pro customer in North Carolina became the first would-be victim of a new malware attack campaign for Trojan:Win32/Emotet. In the next 30 minutes, the campaign tried to attack over a thousand potential victims, all of whom were instantly and...

Pornhub: Stored XSS (client-side, using cookie poisoning) on the pornhubpremium.com

The researcher discovered that a parameter's value was stored in a cookie and that cookie's value was echoed in certain pages. The researcher was successful in providing an XSS payload as this parameter's value and having it execute. DOM XSS through cookie. Discovered by manual inspection of JS...

Netgear WNR1000v3 Cross Site Request Forgery

Exploit Title: NETGEAR WNR1000v3 Router Cross-Site Request Forgery CSRF Date: 03/02/2018 Exploit Author: Sajibe Kanti Author Contact: https://twitter.com/@sajibekantibd Vendor Homepage: http://netgear.com/ Version: WNR1000v3 , Firmware Version V1.0.2.7260.0.96 Tested on Windows 10 Technical Detai...

CVE-2018-6545

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...

CVE-2018-6545

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...

Cross site scripting

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...

CVE-2018-6545

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...

CVE-2018-6545

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw (evidence references human.aspx). The vulnerability could allow attackers to deliver malicious messages to other MoveIt users, potentially stealing session cookies and enabling client-side attacks. The available connec...

IPSwitch MOVEit 8.1 9.4 - Cross-Site Scripting

IPSwitch MOVEit 8.1 9.4 - Cross-Site Scripting Exploit Title: IPSwitch MoveIt Stored Cross Site Scripting XSS Date: 1-31-2017 Software Link: https://www.ipswitch.com/moveit Affected Version: 8.1-9.4 only confirmed on 8.1 but other versions prior to 9.5 may also be vulnerable Exploit Author:...

CVE-2018-6545: Improper Neutralization of Input During Web Page Generation

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...

PT-2018-17625

Name of the Vulnerable Software and Affected Versions Ipswitch MoveIt version 8.1 Description The issue allows attackers to leverage a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by the "human.aspx" endpoint, to send malicious messages to other users. This can lead to the theft...

IPSwitch MoveIt 9.4 Cross Site Scripting Vulnerability

Exploit for asp platform in category web applications Exploit Title: IPSwitch MoveIt Stored Cross Site Scripting XSS Software Link: https://www.ipswitch.com/moveit Affected Version: 8.1-9.4 only confirmed on 8.1 but other versions prior to 9.5 may also be vulnerable Exploit Author: email protecte...

Netis WF2419 Router - Cross-Site Request Forgery

Netis WF2419 Router - Cross-Site Request Forgery Exploit Title: Netis-WF2419 Router Cross-Site Request Forgery CSRF Date: 28/01/2018 Exploit Author: Sajibe Kanti Author Contact: https://twitter.com/@sajibekantibd Vendor Homepage: http://www.netis-systems.com/ Version: Netis-WF2419, V2.2.36123...

Netis-WF2419 Cross Site Request Forgery

Exploit Title: Netis-WF2419 Router Cross-Site Request Forgery CSRF Date: 28/01/2018 Exploit Author: Sajibe Kanti Author Contact: https://twitter.com/@sajibekantibd Vendor Homepage: http://www.netis-systems.com/ Version: Netis-WF2419, V2.2.36123 Tested on: Windows 10 Technical Details & Descriptio...

Netis WF2419 Router - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Netis-WF2419 Router Cross-Site Request Forgery CSRF Exploit Author: Sajibe Kanti Author Contact: https://twitter.com/@sajibekantibd Vendor Homepage: http://www.netis-systems.com/ Version: Netis-WF2419, V2.2.36123 Tested on:...